[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8KQf1RQU-lbAaApP4Yc-xbPsGTM8SmEwgrgi--lGmKo":3},{"article":4,"iocs":41,"watch_terms":56,"solutions":57,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"9ffa8b0e-6a4f-409a-8e48-2727f48fd21e","Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer","hacked-ukrainian-sites-serve-fake-cloudflare-clickfix-lures-for-psychedelic-stea-f6922c","An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. \"When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the","A ClickFix campaign is compromising Ukrainian websites, presenting fake Cloudflare verification pages to trick visitors into downloading a new information stealer called Psychedelic. The malware harvests browser credentials, account tokens, and cryptocurrency wallet data, and establishes persistence by contacting a C2 server. The attack chain involves injecting iframes with malicious JavaScript and using MSI installers to deliver the final payload.","Hacked Ukrainian sites serve fake Cloudflare pages to lure victims into downloading Psychedelic Stealer.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fhacked-ukrainian-sites-serve-fake.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh1xvw3iNKwWUngfdShXBAPKrbRDMZSCQ3_FdiHNKvwrLkip9fUiikko0FKN-cfgzBIgkLvKDR9xIlnfEZVQgHgOW2qTz8Pd4Ur0-DCYdUssgN_9vglgxRU6u5ZRK_FlQYmgV_sbv8pfA1YnSJcojUOhWC-7lkPbA07An_X-vNHmZ8xT2Okq9HiRfTBVt1h\u002Fs1600\u002FUK-CLICK.jpg","2026-09-24T14:29:06+00:00","2026-09-24T20:01:05.33313+00:00",8,[17,20],{"name":18,"type":19},"Cloudflare","technology",{"name":21,"type":22},"ClickFix","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,46,49,53],{"type":43,"value":44,"context":45},"domain","fsputnik[.]com","Domain hosting injected iframe JavaScript",{"type":43,"value":47,"context":48},"uasputnik[.]com","Domain hosting MSI installers",{"type":50,"value":51,"context":52},"ip","107.175.82[.]242","IP address hosting Psychedelic Stealer payload",{"type":27,"value":54,"context":55},"Psychedelic Stealer","Name of the information stealer malware",[],{"controls":58,"vendors":143},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":89,"name":90,"problem":91,"products":92},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":110,"vendor_name":18,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"slug":117,"name":118,"problem":119,"products":120},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[121,128,136],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":122,"product_name":125,"url":126,"description":127},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":117,"product_name":140,"url":141,"description":142},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[144],{"slug":145,"name":146,"logo_path":147,"roles":148},"arctic-wolf","Arctic Wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":165},"fake-cloudflare-pages-on-hacked-ukrainian-sites-spread-psychedelic-stealer","Fake Cloudflare Pages on Hacked Ukrainian Sites Spread Psychedelic Stealer","Attackers compromised legitimate Ukrainian websites by injecting malicious iframes and JavaScript to display convincing fake Cloudflare CAPTCHA verification pages — a ClickFix social engineering technique designed to trick users into voluntarily executing malware. Visitors who followed the prompts inadvertently installed the Psychedelic stealer, which harvests browser credentials, session tokens, and cryptocurrency wallet data. This attack succeeds because users inherently trust recognizable brand interfaces like Cloudflare, lowering their guard against unusual installation requests. The incident highlights the dual risk of website owners failing to secure their CMS platforms and end users lacking awareness of browser-based social engineering tactics. Malware achieving C2 persistence means compromised systems can be leveraged for extended campaigns well beyond the initial infection.",[155,156,157,158,159,160,161,162,163,164],"CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 14 – Security Awareness and Skills Training","CIS Control 18 – Application Software Security","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SC-18 – Mobile Code","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SI-7 – Software, Firmware, and Information Integrity","OWASP Top 10 A03:2021 – Injection","GDPR Article 32 – Security of Processing (for EU-adjacent data exposure)","NIST CSF DE.CM-1 – Network Monitoring and Detection",{"OWASP Top 10 A03:2021 – Injection":166,"NIST SP 800-53 SC-18 – Mobile Code":167,"CIS Control 18 – Application Software Security":168,"NIST SP 800-53 SI-3 – Malicious Code Protection":169,"NIST CSF DE.CM-1 – Network Monitoring and Detection":170,"NIST SP 800-53 AT-2 – Literacy Training and Awareness":171,"CIS Control 14 – Security Awareness and Skills Training":172,"NIST SP 800-53 SI-7 – Software, Firmware, and Information Integrity":173,"CIS Control 4 – Secure Configuration of Enterprise Assets and Software":174,"GDPR Article 32 – Security of Processing (for EU-adjacent data exposure)":175},"The compromised sites were altered via injected code, so input validation and secure coding prevent this foothold.","Controlling mobile code such as injected JavaScript reduces the ability of compromised sites to serve fake verification pages.","Securing website code and plugins prevents attackers injecting malicious iframes and JavaScript into legitimate sites.","Malicious code protection on endpoints helps detect the Psychedelic stealer after a user is tricked into running it.","Monitoring for connections to stealer infrastructure helps detect infected machines exfiltrating credentials and wallet data.","Awareness training helps users distrust unexpected verification prompts even on familiar websites.","Training users that genuine CAPTCHA checks never ask them to run commands counters the fake Cloudflare pages.","Integrity monitoring of website files would alert site owners to the injected iframes and scripts.","Securely configuring browsers and endpoints, for example restricting the Run dialog and script execution, blocks the ClickFix step that installs the stealer.","Appropriate security measures protect personal data such as browser credentials stolen by the malware."]