Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
Summary
A ClickFix campaign is compromising Ukrainian websites to host fake Cloudflare verification pages. These pages trick victims into downloading a new information stealer dubbed 'Psychedelic'. The lure involves instructing users to paste a Windows Installer command into their command line.
IFF Assessment
FOE
This article details a new information stealer and an active campaign, representing a new threat to defenders.
Defender Context
Defenders should be aware of this active campaign targeting Ukrainian businesses and the use of social engineering tactics involving fake Cloudflare pages. The emergence of a new information stealer like Psychedelic requires vigilance and potential updates to detection rules for phishing and malware delivery mechanisms.