Hacked Ukrainian Sites Spread Psychedelic Stealer via Fake Cloudflare ClickFix

An active ClickFix campaign compromises legitimate Ukrainian business websites to inject bogus Cloudflare verification pages. Visitors are tricked into pasting a Windows Installer command into the console, which downloads a previously undocumented information stealer called Psychedelic.

• Attackers hack legitimate Ukrainian business sites to inject fake Cloudflare verification pages
• Victims are told to paste a copied Windows Installer command into the console
• The payload is a previously undocumented stealer named Psychedelic