Ukrainian Websites Compromised with Fake Cloudflare ClickFix to Deploy Psychedelic Stealer

Ukrainian websites were compromised to serve fake Cloudflare verification pages, tricking users into downloading the Psychedelic Stealer malware. The malware steals browser credentials, cryptocurrency wallet data, and establishes persistent C2 communication, targeting Ukrainian users through Russian-linked infrastructure.

An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic.

"When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the

Read original article