Malware
ClickFix Campaign Compromises Ukrainian Sites, Deploys Psychedelic Stealer via Fake Cloudflare Verification
An active ClickFix campaign has injected fake Cloudflare verification pages into legitimate Ukrainian business sites, tricking visitors into running an MSI installer that delivers the Psychedelic stealer. The malware harvests credentials, cryptocurrency wallet data, and establishes persistence via scheduled tasks. Defenders should block the attacker domains, detect MSI executions, and harden web applications against iframe injection.
What Happened
An active ClickFix campaign has injected fake Cloudflare verification pages into legitimate Ukrainian business sites. The lure copies an msiexec.exe command to the clipboard, then instructs users to paste it into the Windows Run dialog, triggering download of an MSI installer that delivers the previously undocumented Psychedelic stealer.
Impact
- Compromised sites: hair‑treatment clinic, scale‑model manufacturer, bookseller, psychological facility, tool retailer, automotive retailer.
- Malware harvests browser passwords, account tokens, cryptocurrency wallet data.
- Establishes scheduled‑task persistence and contacts a C2 server for further instructions.
Technical Details
- Injected iframe loads fsputnik.com/tds/tracker.js.
- MSI installer elita.msi (and variants: miks.msi, astra.msi, etc.) is hosted on uasputnik.com, registered 9 Sep 2026.
- Installer fetches psychedeliclove.exe from 107.175.82…
Mitigation Steps
- Block uasputnik.com and fsputnik.com domains at the perimeter.
- Detect and alert on msiexec.exe executions triggered by clipboard content.
- Implement web‑application firewall rules to strip injected iframes and JavaScript from trusted sites.
- Educate users to avoid copying commands from unverified pages and to verify authenticity of Cloudflare challenges.
What Defenders Should Do
Verify the integrity of your web applications, monitor outbound connections to suspicious IPs, and enforce least‑privilege execution policies for MSI installers.
Related articles
ClickFix Campaign in Ukraine Deploys Lunex Infostealer via Fake Cloudflare Pages
Over 100 Ukrainian websites were hijacked to serve a counterfeit Cloudflare verification page that prompted users to run a PowerShell command. The command installed Lunex Stealer, an infostealer that also installs the LunarAxe browser extension and NaiveMess component, giving attackers credential theft and remote control. Defenders should block malicious domains, monitor for Lunex signatures, and educate users against executing unknown scripts.
Read briefing
Mac Malware Uses Fake CAPTCHA to Steal Keychain Credentials and Drain Crypto Wallets
A Go‑based malware delivered via a ClickFix phishing scam infected macOS systems by executing a terminal command. The payload extracts Keychain passwords and drains cryptocurrency wallets. Defenders should block the malicious domain, update EDR signatures, and audit Keychain access logs.
Read briefing
BTMOB Android RAT: Phishing, Fake App Stores, and Accessibility Exploit
BTMOB is an Android RAT that spreads via phishing sites and counterfeit app stores, then abuses Accessibility Services to gain full device control. The malware is sold with an APK‑builder, enabling rapid, code‑free payloads. Defenders should block malicious domains, disable unknown accessibility services, and enforce app‑store vetting.
Read briefing
RemControl Android Banking Malware Targets European and Canadian Users via Fake IPTV Ads
RemControl, a new Android malware‑as‑a‑service platform, has been delivering banking trojans through fake TVTap IPTV ad sites. The campaign, active since May, targets users in Italy, France, Spain, Poland, Portugal, Canada and the Middle East. Defenders should block known malicious domains, enforce app‑store vetting, and monitor for phishing overlays on Android devices.
Read briefing