The latest ClickFix campaign targeting Ukrainian users demonstrates how attackers are increasingly combining compromised legitimate websites with convincing social engineering to bypass traditional security instincts. Rather than asking victims to trust an unfamiliar domain, the attackers compromise genuine Ukrainian business websites and inject malicious content that redirects visitors into a fake Cloudflare verification process. The victim believes they are completing an ordinary anti-bot check, but the process ultimately convinces them to execute a malicious Windows Installer command themselves.

This distinction is important because users are routinely taught to avoid suspicious links and unknown websites. That guidance becomes far less effective when the initial site is a legitimate business that has itself been compromised. Arctic Wolf observed affected sites belonging to organizations including a hair-treatment clinic, scale-model manufacturer, bookseller and publisher, psychological facility, tool retailer, and automotive retailer. The legitimate websites contained an injected iframe that loaded attacker-controlled JavaScript from fsputnik[.]com/tds/tracker[.]js.

The malicious page imitates a Cloudflare verification screen and presents instructions in Ukrainian. When the victim interacts with it, JavaScript silently copies a command to the clipboard before instructing the visitor to open the Windows Run dialog, paste the command, and execute it. This is the defining characteristic of ClickFix: the browser itself does not exploit a software vulnerability. Instead, the attacker persuades the user to become part of the execution chain. The malicious command uses the legitimate Windows utility msiexec.exe to retrieve and execute an MSI package from attacker infrastructure.

The attack chain is therefore deceptively simple: compromised legitimate website → fake Cloudflare verification → clipboard manipulation → user opens Windows Run → msiexec.exe downloads malicious MSI → Psychedelic Stealer executes. None of these individual actions necessarily looks extraordinary in isolation. Together, however, they create an effective malware-delivery mechanism that avoids the conventional malicious attachment or executable download users may have been trained to recognize.

The observed MSI file, elita.msi, retrieves another executable named psychedeliclove.exe, which Arctic Wolf identified as a previously undocumented 64-bit Windows information stealer called Psychedelic Stealer. Researchers also observed other MSI names including miks.msi, astra.msi, harbor.msi, neon.msi, sova.msi, and vyse.msi, suggesting the operators are prepared to rotate payload names as the campaign evolves.

Psychedelic Stealer is designed to collect credentials from a broad range of Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex. It also extracts account tokens and searches for cryptocurrency wallet information. Targeted browser extensions include MetaMask, Trust Wallet, OKX Wallet, and SafePal, while desktop cryptocurrency software such as Exodus, Atomic Wallet, Electrum, Bitcoin Core, and Litecoin Core is also searched. The malware additionally gathers detailed information about the infected system and reports it to attacker-controlled infrastructure.

This makes the malware particularly dangerous for users who store credentials, active sessions, or cryptocurrency-related secrets inside their browser profiles. A stolen password is serious, but stolen session tokens can sometimes allow attackers to reuse an already authenticated session, potentially reducing the usefulness of protections such as multi-factor authentication. Cryptocurrency wallet information creates a separate financial risk because stolen wallet credentials or secrets can lead to direct and often irreversible asset theft.

The malware goes further than one-time information theft. Arctic Wolf found that Psychedelic terminates selected browser processes, modifies browser profiles, extracts an embedded browser extension, and establishes a native-messaging bridge between browser content and a local host component. A recurring background routine revisits these browser-related operations while the malware continues polling its command-and-control server. This indicates that browser manipulation is part of the malware's ongoing architecture rather than merely an initial data-harvesting step.

Psychedelic can also receive additional tasks from its command-and-control infrastructure. The malware supports execution of multiple payload types, including EXE, COM, BAT, CMD, MSI, and PowerShell content. That means the initial information stealer can effectively become a staging platform for additional malware. Once an endpoint is compromised, the operator is not restricted to stealing browser passwords and cryptocurrency data. They can potentially introduce entirely different tooling depending on the value of the infected system.

The campaign's infrastructure provides another revealing detail. Arctic Wolf discovered an exposed lure-management panel named РУБЛЁВКА TDS (Rublevka TDS) on uasputnik[.]com. The panel allows operators to configure the commands shown through the ClickFix workflow and records user interactions with the lure. At the time of analysis, it contained records for 557 views, 426 clicks, and 79 “complete” events across 32 countries. Ukraine accounted for 446 views, 351 clicks, and 71 complete events, making the campaign's primary geographic focus difficult to miss.

The “complete” event should not be interpreted as proof that malware executed successfully on every corresponding endpoint. Arctic Wolf notes that the lure tracks progression through its web interface rather than actual endpoint execution. This distinction matters because campaign dashboards can exaggerate successful infections if defenders assume every completed lure interaction represents a compromised device. Still, the volume of Ukrainian interactions demonstrates that the operators have succeeded in placing the malicious lure in front of a substantial number of users.

The infrastructure and targeting also raise attribution questions. Arctic Wolf identified Russian-language branding and implementation artifacts and assesses that the operators are likely Russian-speaking. The Ukrainian-language instructions, compromised Ukrainian business websites, and concentration of visitors from Ukraine all strongly support the assessment that Ukrainian users are a primary target. However, these indicators should not be converted into definitive state attribution without additional evidence. The campaign has not been publicly tied to a specific known threat actor or government organization.

This caution is particularly important because Ukraine has already faced separate ClickFix activity attributed to Russia-linked groups. Earlier in 2026, CERT-UA reported that UAC-0145, a subgroup associated with Sandworm, used fake CAPTCHA checks and ClickFix techniques against Ukrainian targets. That demonstrates broader interest in the technique among threat actors targeting Ukraine, but it does not establish that the Psychedelic campaign is operated by the same group.

The campaign highlights why compromised legitimate websites have become particularly valuable malware-delivery mechanisms. Domain reputation is useful, but it is not equivalent to current integrity. A website may have existed harmlessly for years and possess an excellent reputation score, yet still serve malicious JavaScript today if its CMS, plugin, credentials, hosting environment, or administrative account has been compromised. Defenders therefore need to evaluate what a page is doing now rather than relying exclusively on the historical reputation of the domain.

For website owners, this campaign reinforces the need for continuous file-integrity and JavaScript monitoring. Administrators should watch for unauthorized iframe injection, modifications to templates, unexpected third-party scripts, new administrator accounts, changes to CMS plugins, and external JavaScript references that were not part of the approved site configuration. Content Security Policy can also help restrict which external sources a browser is allowed to execute, although its value depends heavily on how tightly the policy is configured.

For endpoint defenders, the ClickFix behavior itself provides stronger detection opportunities than any individual malicious domain. Useful signals include a browser session followed closely by execution of msiexec.exe, PowerShell, cmd.exe, or another command interpreter; MSI packages retrieved from unfamiliar Internet hosts; clipboard-derived commands; unusual browser-profile modifications; newly created scheduled tasks; and subsequent credential-access behavior. The domains and filenames can change in minutes. The browser-to-Run-dialog-to-installer sequence is harder for attackers to abandon without redesigning the campaign.

User education also needs to become simpler and more specific. Telling users merely not to click suspicious links is increasingly inadequate. A more useful message is: A website should never require you to open the Windows Run dialog, PowerShell, Terminal, or Command Prompt and paste a command in order to verify that you are human. Cloudflare, Google, Microsoft, and other legitimate verification services do not require users to execute operating-system commands to complete a CAPTCHA.

The wider cybersecurity lesson is that ClickFix has become successful precisely because attackers have found a way to convert security-conscious user behavior into an attack mechanism. Users have learned to distrust downloaded executables, so the attacker places the command in the clipboard instead. Users have learned to trust familiar CAPTCHA and Cloudflare verification pages, so the attacker imitates them. Users have learned to prefer established websites, so the attacker compromises legitimate websites rather than directing victims only to obviously malicious ones.

The Psychedelic campaign brings these techniques together particularly effectively: trusted website → fake verification → legitimate Windows utility → malicious MSI → credential stealer → browser modification → persistence → additional task execution. Every stage borrows trust from something familiar.

The most important lesson is therefore not simply to block fsputnik[.]com, uasputnik[.]com, or the currently known command-and-control infrastructure. Those indicators will eventually change. Organizations should instead detect the behavior that connects the stages.

When a trusted website suddenly instructs a user to execute an operating-system command, trust in that website should end immediately.

And when attackers can compromise legitimate websites and turn visitors into their own malware installers, both website integrity monitoring and endpoint behavioral detection become essential parts of the same defensive strategy.

An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. "When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the

Source: Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer via The Hacker News — published 24 Sep 2026.