Compromised Ukrainian business sites are serving a ClickFix lure that installs through msiexec
Arctic Wolf Labs found injected iframes on real Ukrainian business sites showing a Ukrainian-language fake Cloudflare check that copies a Windows Installer command for the visitor to paste into Run. Its exposed panel logged 557 views.
The Watch · Security desk
What happened
- Arctic Wolf Labs says attackers injected iframes into legitimate Ukrainian business websites, loading a Ukrainian-language fake Cloudflare verification page from infrastructure the attackers control.
- Interacting with the page copies a Windows Installer command to the clipboard and tells the visitor to paste it into the Windows Run dialog; the MSI it retrieves installs an infostealer tagged Psychedelic.
- The implant takes browser passwords, account tokens and cryptocurrency-wallet data, deploys browser components, persists through a scheduled task and polls its C2 for further tasks and payloads.
- An exposed lure-management panel held per-domain command configuration and had recorded 557 page views across 32 countries, 446 of them assigned to Ukraine.
Why it matters
- What it limits constraint Detection tuned to base64 in a PowerShell command line started from a Run-dialog paste will not fire on this chain, because the process fetching the payload is msiexec.
- Who's exposed exposure The people reached are the compromised businesses' own customers, arriving through normal site traffic with no phishing email and no unfamiliar domain to inspect.
- What doesn't add up contradiction The 32-country spread rests on 111 views outside Ukraine, so it measures how far the lure page loaded and cannot be read as a count of infected machines abroad.
- Who has to decide decision Two Windows settings now have a live technique behind them: whether standard users keep the Run dialog, and whether user-context installs of remote MSI packages are permitted.
Next story · Build · 1h ago
Cloudflare's Deno deal gives the runtime one more year of monthly fixesConfirmed2 publishers
The panel decides how big this campaign looks, and it is the piece most easily over-read. It held per-domain command configuration, so an operator could set which command each compromised site copied to a visitor's clipboard [5]. It also counted views, clicks and completions. Arctic Wolf Labs wrote that those events "do not independently confirm malware execution or successful compromise" [7].
Outside Ukraine the counts are thin. 557 views with 446 assigned to Ukraine leaves 111 for the other 31 countries, an average of about 3.6 views each, and Ukraine accounts for roughly 80 percent of everything the panel logged [6][15].
Delivery is what separates this from mass-mailed ClickFix. Arctic Wolf found lures on sites belonging to a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller and publisher, a psychological facility, a tool retailer and an automotive retailer [8]. Established social media accounts and backlinks from third-party business listings supported its assessment that those domains belonged to real operating businesses [9]. The injected script, once deobfuscated, referenced fsputnik[.]com/tds/tracker.js [12]. WHOIS puts the registration of uasputnik[.]com at September 9, 2026, 17:02:25 UTC [10].
A blocklist built on unfamiliar-looking hosts does not help here, because the page the visitor trusts is the clinic's own and the traffic is the clinic's existing traffic [1]. When the visitor selects "Done," the lure posts a bp-reload-parent message to the parent origin so the compromised host page reloads [13].
The lure is Ukrainian-language and the traffic panel behind it is Russian-branded [11]. A /tds/ path, per-domain command configs and view telemetry describe a configurable traffic distribution setup serving several compromised domains at once [5][12].
Execution turns on two user-side steps. The clipboard carries an msiexec command instead of the encoded PowerShell one-liner most ClickFix chains use [3], so the process that reaches out for the payload is Windows Installer requesting a remote package [2]. Either step breaks the chain: removing the Run dialog from standard users, or refusing user-context installs of remote MSI packages [14]. What lands if both hold is an implant that takes browser passwords, account tokens and wallet data, writes a scheduled task, and polls its C2 for more work [4].
What to watch
- Whether Arctic Wolf publishes the initial access path into the Ukrainian sites, which would show if one CMS or plugin flaw links them.
- Whether the same per-domain panel configuration turns up behind non-Ukrainian lures, which would indicate a shared traffic service rather than one operator.
- Whether the fsputnik and uasputnik infrastructure rotates to fresh domains now that the panel has been described publicly.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption14
- Hype gap+8
- Incentives35
- Confidence64
Perspective Coverage
3 publishers- Builder
- Builder 30%
- Operator
- Operator 64%
- Investor
- Investor 6%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Arctic Wolf Labs is tracking an ongoing campaign that compromises legitimate Ukrainian business websites and uses injected iframes to display a Ukrainian-language fake Cloudflare verification page to existing visitors and customers, rather than relying on direct traffic to an unfamiliar malicious domain.
- [2]
When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the Windows Run dialog; the command retrieves an MSI package that delivers a previously unidentified infostealer containing the embedded tag "Psychedelic".
- [3]
The ClickFix flow used Windows Installer instead of an encoded PowerShell command: the lure copied an msiexec command before showing instructions to paste and execute it through Windows Run.
- [4]
Psychedelic Stealer targets browser passwords, account tokens and cryptocurrency-wallet data, deploys browser-support components, establishes scheduled-task persistence, polls its command-and-control server for additional tasks and supports additional payload execution.
- [5]
An exposed lure-management panel revealed domain-specific command configuration and interaction telemetry, and configured the commands as well as measuring lure interaction.
- [6]
The panel recorded 557 views across 32 countries, including 446 assigned to Ukraine.
- [7]
Arctic Wolf Labs wrote that the panel's view, click and "complete" events "do not independently confirm malware execution or successful compromise".
- [8]
Arctic Wolf identified campaign lures associated with multiple Ukrainian businesses, including a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller and publisher, a psychological facility, a tool retailer and an automotive retailer.
- [9]
Indicators including established social media accounts and references or backlinks from third-party business listings supported Arctic Wolf's assessment that the affected domains belonged to real operating businesses that had been compromised rather than imitated.
- [10]
According to WHOIS data, the malicious domain uasputnik[.]com was registered on September 9, 2026 at 17:02:25 UTC.
- [11]
Arctic Wolf describes the campaign as a Ukrainian-branded ClickFix lure with a Russian-branded traffic panel.
- [12]
After deobfuscation, the injected script on affected sites referenced hxxps://fsputnik[.]com/tds/tracker[.]js.
- [13]
After the visitor completes the malicious CAPTCHA and selects "Done," the lure sends a bp-reload-parent message to the parent origin, behaviour consistent with embedded content instructing the compromised host page to reload.
- [14]
The chain has two user-side chokepoints: the paste of the command into the Windows Run dialog, and Windows Installer's retrieval of the remote MSI package.
- [15]
Excluding Ukraine, the panel logged 111 views across the remaining 31 countries, an average of about 3.6 views per country, and Ukraine accounts for about 80 percent of recorded views.
Sources
3 independent publishers whose own reporting we read for this story.
- arcticwolf.comThe Psychedelic Stealer: When a CAPTCHA Becomes an Installer
1 article · September 24, 2026
- securityaffairs.comClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer
1 article · September 25, 2026
- thehackernews.comHacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
1 article · September 24, 2026
Topics and entities
Topics
- Infostealer Malware
- Cyber threats against Ukraine
- Compromised websites
- ClickFix
Entities
- Windows Installer
- Cloudflare
- Psychedelic Stealer
- Arctic Wolf
- Arctic Wolf Labs