Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer

A campaign known as ClickFix has been compromising Ukrainian business websites, using them to host fake Cloudflare verification pages. These pages trick visitors into downloading an information stealer called Psychedelic. The fake verification pages copy a Windows Installer command to the visitor's clipboard and provide instructions to paste it into the command line. This action likely leads to the installation of the Psychedelic stealer. The Psychedelic stealer itself is previously undocumented. The campaign's use of legitimate websites to host the fake verification pages may increase the likelihood of successful infections.