{"id":796,"date":"2026-09-25T13:46:49","date_gmt":"2026-09-25T10:46:49","guid":{"rendered":"https:\/\/hosting.in.ua\/blog\/?p=796"},"modified":"2026-09-25T13:46:50","modified_gmt":"2026-09-25T10:46:50","slug":"new-clickfix-threat-how-hackers-breach-ukrainian-websites-to-spread-psychedelic-stealer-via-fake-cloudflare-verification","status":"publish","type":"post","link":"https:\/\/hosting.in.ua\/blog\/en\/safety\/new-clickfix-threat-how-hackers-breach-ukrainian-websites-to-spread-psychedelic-stealer-via-fake-cloudflare-verification\/","title":{"rendered":"New ClickFix Threat: How Hackers Breach Ukrainian Websites to Spread Psychedelic Stealer via Fake Cloudflare Verification"},"content":{"rendered":"
\n
\n

A backdoor disguised as a Cloudflare check, clipboard hijacking, and the theft of passwords, tokens, and crypto wallets \u2014 this is how the new cyberattack campaign targeting the Ukrainian web segment operates.<\/p>\n<\/header>\n

Cybersecurity researchers (including Arctic Wolf Labs<\/em> and The Hacker News<\/em>) have reported widespread compromise of legitimate Ukrainian websites. Compromised resources display a fake “I am not a robot” verification window that trick users into executing malicious code on their Windows systems manually.<\/p>\n

In this article, we break down the mechanics of the ClickFix<\/strong> attack, the anatomy of the Psychedelic Stealer<\/strong>, and provide a defense checklist for website owners and general users alike.<\/p>\n

\n

1. What is ClickFix and Why is This Technique So Dangerous?<\/h2>\n

ClickFix<\/strong> is a social engineering tactic that, instead of relying on traditional malware downloads, deceives the visitor into manually running a malicious command on their local machine.<\/p>\n

How the Attack Vector Works:<\/h3>\n
    \n
  1. Website Compromise (Initial Access):<\/strong> Attackers exploit CMS vulnerabilities (such as outdated WordPress plugins) or steal admin credentials.<\/li>\n
  2. Script Injection:<\/strong> A third-party iframe<\/code> is embedded into the site to load malicious JavaScript in the background.<\/li>\n
  3. Fake Cloudflare CAPTCHA:<\/strong> The victim sees a realistic “Verify you are human” Cloudflare prompt localized in Ukrainian.<\/li>\n
  4. Clipboard Hijacking:<\/strong> When the user clicks the verification button, a background script automatically copies a malicious command to their clipboard.<\/li>\n
  5. Social Engineering Prompt:<\/strong> An instruction pops up on screen:
    \n

    “Press Win + R → Paste text (Ctrl + V) → Press Enter”<\/p><\/blockquote>\n<\/li>\n<\/ol>\n

    If the visitor follows these instructions, Windows launches the native msiexec.exe<\/code> utility, which silently downloads a malicious .msi<\/code> installer from the attackers’ command-and-control (C2) server and deploys the stealer.<\/p>\n

    <\/p>\n

    \n \"Fake
    Fake Cloudflare verification window with deceptive Win + R instructions<\/figcaption><\/figure>\n

    2. Psychedelic Stealer Analysis: What Data Does It Target?<\/h2>\n

    The payload delivered via this method is a newly observed malware strain \u2014 Psychedelic Stealer<\/strong>. It is a 64-bit infostealer engineered to harvest a broad spectrum of sensitive information:<\/p>\n

      \n
    • Credentials & Passwords:<\/strong> Extracts stored browser passwords, cookies, and session data across Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, etc.).<\/li>\n
    • Crypto Wallets:<\/strong> Scans browser extensions and desktop apps for sensitive wallet data (MetaMask, Trust Wallet, Exodus, Electrum, Bitcoin Core, and others).<\/li>\n
    • Session Tokens:<\/strong> Steals active session tokens to bypass multi-factor authentication (2FA).<\/li>\n
    • Persistence:<\/strong> Establishes persistence by creating scheduled tasks in Windows (Scheduled Tasks<\/code>), ensuring it remains active after system reboots and remains ready to receive new commands.<\/li>\n<\/ul>\n

      <\/p>\n

      \n \"Diagram
      Attack chain flow: from CMS compromise to clipboard hijacking and C2 exfiltration<\/figcaption><\/figure>\n

      3. Why Ukrainian Businesses Are Targeted<\/h2>\n

      Security analysts note that attackers are actively compromising Ukrainian business websites \u2014 ranging from private clinics and publishing houses to auto parts retailers. <\/p>\n

      Visitors naturally trust familiar domain names, unaware that the underlying site has been injected with malicious code. Network traces, language localizations, and administrative panel branding point to Russian-aligned cybercrime groups behind this campaign.<\/p>\n

      4. Security Checklist: How to Protect Your Website and Server<\/h2>\n

      A. For Website Owners & Webmasters:<\/h3>\n
        \n
      • Update CMS & Plugins:<\/strong> Most injections occur due to outdated WordPress\/OpenCart core versions or vulnerable plugins.<\/li>\n
      • File Integrity Monitoring:<\/strong> Set up automated integrity checks to detect unauthorized iframe<\/code> insertions or external JavaScript scripts.<\/li>\n
      • Enforce Strict Content Security Policy (CSP):<\/strong> Restrict the external domains from which your site can load executable scripts.<\/li>\n
      • Isolated Offsite Backups:<\/strong> Maintain daily automated backups on isolated, offsite storage separate from your primary web server.<\/li>\n<\/ul>\n

        B. For Users & Employees:<\/h3>\n

        Rule of thumb:<\/strong> Legitimate services (Cloudflare, Google, Microsoft) will NEVER<\/strong> ask you to press Win + R<\/code> and paste commands from your clipboard!<\/p>\n

        If you accidentally pasted and executed such a command, immediately disconnect your device from the network, change all passwords from a clean device, and notify your system administrator.<\/p>\n

        \n

        <\/p>\n

        \n

        Frequently Asked Questions (FAQ)<\/h2>\n
        \n

        How can I distinguish real Cloudflare checks from fake ones?<\/h3>\n
        \n

        Authentic Cloudflare checks operate automatically in the background or ask you to click a Turnstile checkbox directly on the webpage. Real checks will never instruct you to open system command prompts or use keyboard shortcuts like Win + R.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

        \n

        What should I do if I already ran the command in Win + R?<\/h3>\n
        \n
          \n
        1. Immediately disconnect the device from the internet (unplug Ethernet or turn off Wi-Fi).<\/li>\n
        2. Terminate the msiexec.exe<\/code> process via Windows Task Manager.<\/li>\n
        3. Run a full system scan using updated antivirus software.<\/li>\n
        4. Revoke active sessions and reset all passwords, API keys, and crypto credentials using a separate, secure device.<\/li>\n<\/ol><\/div>\n<\/p><\/div>\n<\/section>\n

          <\/p>\n