As reported by SecurityAffairs, a new ClickFix campaign is distributing Psychedelic Stealer by injecting hidden iframes into legitimate Ukrainian business websites — a hair clinic, bookseller, tool retailer, and others — and serving visitors a convincing fake Cloudflare CAPTCHA. The attack is notable not for novelty in any single component, but for how effectively it stacks evasion techniques: trusted infrastructure, social engineering that mimics a familiar brand, and a deliberate pivot away from PowerShell to msiexec.exe.

Threat Alert: As reported by SecurityAffairs, a new ClickFix campaign is distributing Psychedelic Stealer by injecting hidden iframes into legitimate Ukrainian business websites — a hair clinic, bookseller, tool retailer, and others — and serving visitors a convincing fake Cloudflare CAPTCHA.

Why This Campaign Deserves Attention

ClickFix has been circulating for over a year, but this iteration closes several gaps that previously made it easier to detect. The shift from stand-alone attacker-controlled domains to compromised but established business sites fundamentally changes the defender's problem. URL reputation, domain age checks, and allow-listing based on prior visit history — all common endpoint and web gateway controls — are neutralized when the malicious content is served from a domain the user has legitimately visited before.

The fake Cloudflare verification page is well-constructed. It includes a randomly generated hexadecimal “Ray ID” and a fixed visitor identifier, both designed to mimic Cloudflare's actual tracking markers. As Arctic Wolf's report notes, these identifiers are pure window dressing — they carry no verification value. But they exploit a cognitive shortcut: users have been trained to associate Cloudflare interstitials with safety. When that interstitial appears on a site they already trust, the social engineering hook becomes significantly harder to resist.

The most dangerous aspect of this campaign is not the malware payload — it's the convergence of trusted infrastructure, familiar UI patterns, and a delivery mechanism that sidesteps the most heavily monitored execution path on Windows.

The PowerShell Avoidance Problem

Most ClickFix variants historically relied on PowerShell commands copied to the clipboard. That made them relatively easy to catch: PowerShell script-block logging, AMSI integration, and Constrained Language Mode have matured significantly. This campaign deliberately avoids PowerShell entirely, instead using msiexec.exe to launch a remote MSI package. This is a meaningful tactical shift.

Defenders who have invested heavily in PowerShell monitoring — and many have — will find that their detection coverage has a blind spot here. msiexec.exe is a signed, legitimate Windows binary. While it can be instrumented, it typically receives far less scrutiny in detection engineering pipelines. The attack also instructs users to press Windows+R and paste the command, which means execution happens through cmd.exe or the Run dialog — not through a script interpreter that might trigger behavioral rules.

What Psychedelic Stealer Tells Us About the Threat Landscape

Psychedelic Stealer targets browser credentials and cryptocurrency wallets — a common but lucrative combination. The choice of Ukrainian business sites as injection points, combined with Russian-language HTML comments and a lang="ru" declaration in the fake page, suggests a Russian-speaking threat actor operating in the region. This is consistent with the broader pattern of financially motivated cybercrime groups in Eastern Europe targeting both regional and global victims.

The infostealer market remains saturated, but delivery methodology is where differentiation occurs. Campaigns that can reliably bypass endpoint detection for longer periods command higher value in the crimeware ecosystem. ClickFix's evolution suggests the technique is being refined by operators who understand defender telemetry.

Shield53 Recommendations

Immediate Actions

What Psychedelic Stealer Tells Us About the Threat Landscape
Deploy msiexec.exe monitoring: Enable detection rules for msiexec.exe invocations with remote URLs (/i http or /i https arguments). This is the single most impactful detection gap in this campaign.
Monitor clipboard activity: While clipboard monitoring raises privacy considerations, enterprise EDR platforms can flag clipboard content containing msiexec, cmd, or powershell strings without capturing full clipboard contents.
Restrict msiexec from remote sources: Consider Application Control policies (WDAC, AppLocker) that block msiexec.exe from executing packages fetched from remote URLs.
User awareness training: Specifically train users that Cloudflare challenges never require pasting commands into Windows+R. This is the social engineering weak point — if users understand this single rule, the attack fails.

Strategic Actions

  • Web content integrity monitoring: If your organization operates public-facing websites, deploy file integrity monitoring and CSP headers to detect iframe injections. The compromised Ukrainian sites likely had no such controls.
  • Review EDR coverage gaps: Audit your detection rules for coverage of LOLBins beyond PowerShell. msiexec.exe, regsvr32.exe, rundll32.exe, and mshta.exe all deserve equivalent scrutiny.
  • Credential hygiene: Ensure browser-stored credentials and crypto wallet extensions are protected by separate strong authentication. Infostealers primarily target lazily stored credentials — reducing stored secrets reduces blast radius.

The ClickFix technique will continue to evolve as long as it remains effective. The defensive lesson here is broader than any single campaign: over-indexing on one execution vector (PowerShell) creates predictable blind spots. Defenders need detection coverage that accounts for the full spectrum of living-off-the-land binaries, not just the ones that have been historically popular.