Compromised websites are being turned into fake Cloudflare checks
An active ClickFix campaign is abusing legitimate Ukrainian business websites to display counterfeit Cloudflare verification pages. The page is not verifying a visitor at all. It persuades the visitor to run a Windows Installer command, leading to a newly documented information stealer called Psychedelic Stealer. Arctic Wolf Labs reported the activity, and the key operational lesson is simple: a familiar website and a familiar Cloudflare brand do not make an instruction to open Windows Run safe.
The compromised sites span a hair-treatment clinic, scale-model maker, specialist bookseller and publisher, psychological facility, tool retailer, and automotive retailer. Attackers inject an iframe into those sites. That iframe loads attacker-controlled JavaScript from fsputnik[.]com/tds/tracker[.]js and presents Ukrainian-language instructions through the fake verification screen.
How the ClickFix chain works
After a visitor interacts with the lure, it copies a command to the clipboard and asks the person to paste it into the Windows Run dialog. The command invokes msiexec.exe to obtain a malicious MSI installer. Researchers identified elita.msi hosted on uasputnik[.]com, a domain registered on September 9, 2026. Other observed MSI names include miks.msi, astra.msi, harbor.msi, neon.msi, sova.msi, and vyse.msi.
The lure is designed to look procedural rather than alarming. It shows a spinner for about three seconds, then an instruction dialog; its Done button stays disabled for roughly another 35 seconds. That timing does not check whether Windows Run was opened or whether the command executed. It merely paces the victim through the deception. Legitimate Cloudflare challenges never require users to paste a clipboard command into Run or launch msiexec.
What Psychedelic Stealer can collect and change
The MSI fetches psychedeliclove.exe from 107.175.82[.]242:9000. This 64-bit executable targets passwords in Chromium-based browsers: Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex. It also collects browser-associated account tokens and searches for wallet extensions including MetaMask, Trust Wallet, OKX Wallet, and SafePal, plus desktop wallets such as Exodus, Atomic Wallet, Electrum, Bitcoin Core, and Litecoin Core.
Reported collection paths include /api/v1/ext/passwords, /api/v1/ext/tokens, /api/v1/ext/wallets, and host check-in at /api/v1/checkin. The malware can terminate selected browsers, unpack an extension archive into browser profiles, and establish a native-messaging bridge. It revisits extension-related activity in the background, then polls /api/v1/agent/tasks?hwid=%s for further work. Operators can potentially deliver EXE, COM, BAT, CMD, MSI, and PowerShell payloads. Treat an endpoint that ran the lure command as a possible continuing compromise, not merely a password-theft event.
Campaign visibility and indicators
Arctic Wolf identified a lure-management panel named РУБЛЁВКА TDS (Rublevka TDS) on uasputnik[.]com. It is separate from the implant C2 at 193.178.159[.]128:8080. At the time of analysis, the panel showed 557 views, 426 clicks, and 79 completed events across 32 countries. Ukraine accounted for 446 views, 351 clicks, and 71 completions; the United States, Poland, Germany, Canada, and the Netherlands also appeared. Russian-language branding and implementation artifacts, alongside Ukrainian instructions and victim sites, support the researchers’ assessment of a strong focus on Ukrainian users.
Practical administrator checklist
- Tell users immediately that Cloudflare does not ask them to open Windows Run, paste clipboard content, or run installers.
- Hunt endpoint telemetry for
msiexec.exe,psychedeliclove.exe, named MSI files, listed domains/IPs, and unusual PowerShell activity. - Isolate any endpoint where the command ran; retain logs and artifacts before cleanup.
- Reset credentials and revoke browser sessions/tokens from a known-clean device; prioritize privileged and cryptocurrency-related accounts.
- Inspect browser profiles, new extensions, scheduled tasks, and native-messaging registrations. Run a full EDR investigation.
- Block the listed indicators in DNS, proxy, and endpoint controls. Review web filtering and user-awareness guidance.
- If operating a website, investigate unexpected iframes or scripts, audit CMS administration access, and patch the initial intrusion path.
Conclusion
This campaign succeeds by converting trust in a legitimate site and the Cloudflare name into user-driven execution. Preventing clipboard-to-Run behavior, monitoring msiexec, and rapidly isolating affected machines are practical priorities. Never execute a command supplied by a web page, even when that page appears to be a security check.
Source: The Hacker News, September 24, 2026, reporting Arctic Wolf Labs research.