Fake Cloudflare CAPTCHA on compromised Ukrainian websites installs Psychedelic Stealer malware

Attackers compromised legitimate Ukrainian business websites and used fake Cloudflare verification pages to trick visitors into installing malware. Arctic Wolf says the campaign injects attacker-controlled iframes into real sites, then uses a ClickFix-style lure that copies an msiexec command and tells users to paste it into the Windows Run dialog. The downloaded MSI installs a newly identified infostealer dubbed Psychedelic Stealer, which steals browser passwords, account tokens, and cryptocurrency-wallet data, sets scheduled-task persistence, and can fetch additional payloads. A leaked management panel showed 557 lure interactions across 32 countries, mostly in Ukraine.