New ClickFix Threat: How Hackers Breach Ukrainian Websites to Spread Psychedelic Stealer via Fake Cloudflare Verification

Cybersecurity researchers (including Arctic Wolf Labs and The Hacker News) have reported widespread compromise of legitimate Ukrainian websites. Compromised resources display a fake “I am not a robot” verification window that trick users into executing malicious code on their Windows systems manually.

In this article, we break down the mechanics of the ClickFix attack, the anatomy of the Psychedelic Stealer, and provide a defense checklist for website owners and general users alike.

1. What is ClickFix and Why is This Technique So Dangerous?

ClickFix is a social engineering tactic that, instead of relying on traditional malware downloads, deceives the visitor into manually running a malicious command on their local machine.

How the Attack Vector Works:

1. Website Compromise (Initial Access): Attackers exploit CMS vulnerabilities (such as outdated WordPress plugins) or steal admin credentials.
2. Script Injection: A third-party iframe is embedded into the site to load malicious JavaScript in the background.
3. Fake Cloudflare CAPTCHA: The victim sees a realistic “Verify you are human” Cloudflare prompt localized in Ukrainian.
4. Clipboard Hijacking: When the user clicks the verification button, a background script automatically copies a malicious command to their clipboard.
5. Social Engineering Prompt: An instruction pops up on screen:
   

   “Press Win + R → Paste text (Ctrl + V) → Press Enter”

If the visitor follows these instructions, Windows launches the native msiexec.exe utility, which silently downloads a malicious .msi installer from the attackers’ command-and-control (C2) server and deploys the stealer.

2. Psychedelic Stealer Analysis: What Data Does It Target?

The payload delivered via this method is a newly observed malware strain — Psychedelic Stealer. It is a 64-bit infostealer engineered to harvest a broad spectrum of sensitive information:

• Credentials & Passwords: Extracts stored browser passwords, cookies, and session data across Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, etc.).
• Crypto Wallets: Scans browser extensions and desktop apps for sensitive wallet data (MetaMask, Trust Wallet, Exodus, Electrum, Bitcoin Core, and others).
• Session Tokens: Steals active session tokens to bypass multi-factor authentication (2FA).
• Persistence: Establishes persistence by creating scheduled tasks in Windows (Scheduled Tasks), ensuring it remains active after system reboots and remains ready to receive new commands.

3. Why Ukrainian Businesses Are Targeted

Security analysts note that attackers are actively compromising Ukrainian business websites — ranging from private clinics and publishing houses to auto parts retailers.

Visitors naturally trust familiar domain names, unaware that the underlying site has been injected with malicious code. Network traces, language localizations, and administrative panel branding point to Russian-aligned cybercrime groups behind this campaign.

4. Security Checklist: How to Protect Your Website and Server

A. For Website Owners & Webmasters:

• Update CMS & Plugins: Most injections occur due to outdated WordPress/OpenCart core versions or vulnerable plugins.
• File Integrity Monitoring: Set up automated integrity checks to detect unauthorized iframe insertions or external JavaScript scripts.
• Enforce Strict Content Security Policy (CSP): Restrict the external domains from which your site can load executable scripts.
• Isolated Offsite Backups: Maintain daily automated backups on isolated, offsite storage separate from your primary web server.

B. For Users & Employees:

Rule of thumb: Legitimate services (Cloudflare, Google, Microsoft) will NEVER ask you to press Win + R and paste commands from your clipboard!

If you accidentally pasted and executed such a command, immediately disconnect your device from the network, change all passwords from a clean device, and notify your system administrator.