Loading story…
An ongoing ClickFix campaign has compromised legitimate Ukrainian business websites and injected iframes that display a Ukrainian-language counterfeit Cloudflare verification page. The page copies an msiexec command to a visitor’s clipboard and instructs them to paste it into Windows Run, downloading an MSI installer for the previously unidentified Psychedelic Stealer.
Psychedelic Stealer targets browser passwords, browser-associated tokens, and cryptocurrency-wallet data, creates scheduled-task persistence, deploys browser components, and polls command-and-control infrastructure for further instructions. An exposed Russian-branded lure-management panel logged 557 interactions across 32 countries—446 in Ukraine—although those figures do not confirm execution or compromise. Arctic Wolf Labs has not attributed the operation, while noting that Russian-language artifacts suggest but do not establish Russian involvement.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
The domain uasputnik[.]com, used to host the observed MSI installer, was registered. It was associated with IP address 176.53.159[.]40 from September 9 through September 14, 2026.
An exposed lure-management panel branded "РУБЛЁВКА TDS" recorded 557 page views, 426 CAPTCHA clicks, and 79 completion events across 32 countries, including 446 views in Ukraine. The telemetry tracked lure interactions rather than verified malware execution or endpoint compromise.
The MSI delivery chain led to a previously unidentified Windows malware payload that Arctic Wolf named Psychedelic Stealer based on its embedded configuration tag. The malware steals browser passwords, tokens, and cryptocurrency-wallet data; creates scheduled-task persistence; and can retrieve and execute additional payloads from its C2.
An ongoing campaign compromised legitimate Ukrainian business websites and injected attacker-controlled iframes displaying a Ukrainian-language fake Cloudflare verification page. The lure instructed visitors to run a clipboard-copied msiexec command that downloaded an MSI installer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security agencies and researchers warned that **ClickFix** social-engineering attacks are spreading through fake verification and brand-impersonation pages that mimic services such as **Google reCAPTCHA** and **Cloudflare**, then trick users into opening `Win+R` or Terminal and pasting clipboard-loaded commands. Recent campaigns have used poisoned websites, fake search results, and spoofed update pages to push victims into launching malicious PowerShell, `mshta`, WebDAV, or shell-based payloads, turning trusted brands and verification flows into an initial access vector without directly compromising the impersonated organizations. The activity has delivered a wide range of malware, including **ACR Stealer**, **HijackLoader**, **StealC**, **Remus**, **Amatera Stealer**, **CastleLoader**, **NetSupport**, Rust-based stealers, and a DPRK-linked macOS backdoor tied to **Contagious Interview**. Microsoft said ACR Stealer campaigns targeting enterprise users stole browser credentials, cookies, tokens, and business files, used scheduled tasks and process injection for persistence and evasion, and in some cases relied on **EtherHiding** to resolve command-and-control infrastructure from Ethereum smart contracts; the macOS campaign similarly used clipboard-driven execution, LaunchAgent persistence, and follow-on payloads that targeted browser data, developer and cloud keys, and cryptocurrency wallets. Defenders were urged to block command execution from untrusted prompts, hunt for published indicators of compromise, and educate users that legitimate verification pages do **not** require running commands locally.
Jul 31, 2026
A wave of **social-engineering-driven malware delivery** is abusing “verification” and “fix” workflows to trick users into running attacker-supplied commands that install information stealers. LevelBlue reported a campaign using **fake Cloudflare-style CAPTCHA pages** on compromised websites to convince Windows users to manually execute malicious **PowerShell** commands, resulting in **StealC** deployment; StealC is described as exfiltrating browser credentials, crypto wallet data, Steam and Outlook credentials, system information, and screenshots over **RC4-encrypted HTTP** to a C2 server. Intego also identified an evolved **ClickFix** technique on macOS (“**Matryoshka**”) that leverages **typosquatting** to redirect users to pages instructing them to paste “fix” commands into Terminal; the loader then retrieves an AppleScript payload to steal browser credentials and target wallet apps (e.g., *Trezor Suite*, *Ledger Live*), including repeated fake password prompts as a fallback. Separately, other credential-theft campaigns are also leaning heavily on lures that exploit user trust and routine workflows. Morphisec described **Noodlophile** evolving from fake AI video platform ads to **fake job postings** and phishing “assessments,” delivering multi-stage stealers/RATs via techniques including **DLL sideloading**, while continuing to use **Telegram bots** for exfiltration/C2 and adding file-bloating content intended to disrupt automated analysis. These developments reinforce that user-in-the-loop execution (copy/paste commands, “verification” steps, and recruitment-themed forms) remains a high-yield initial access vector for stealers across both Windows and macOS environments.
Jun 29, 2026
Threat actors used compromised legitimate websites—especially **WordPress** sites—to display fake CAPTCHA or browser-verification prompts that trick visitors into manually running malicious commands, resulting in information-stealer infections. Kroll reported that the **CLEARFAKE** campaign evolved from fake browser updates to a **ClickFix-style** technique in which victims copy, paste, and execute malicious PowerShell, while CyberCX linked a similar **DarkEngine** operation to at least **2,353** likely compromised WordPress sites after attackers allegedly stole administrator credentials through SEO-poisoned phishing pages and fake **WP Engine** logins. The campaigns relied on injected JavaScript and increasingly evasive delivery methods, including **EtherHiding**, which retrieves attacker-controlled code from the **BNB Smart Chain** through blockchain-related endpoints. Observed payloads decoded obfuscated content, downloaded follow-on malware, and performed discovery and credential theft, while NJCCIC said related ClickFix activity installed **MonsterV2** and could also deliver **StealC** or **Rhadamanthys**. Stolen data included browser information, account credentials, cryptocurrency wallets, and other sensitive personal information, showing how fake verification prompts on trusted sites are being used as an effective malware-delivery channel.
Aug 15, 2026