Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer

An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. "When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the

The report describes a ClickFix campaign in which compromised Ukrainian business websites display fake Cloudflare verification pages that instruct visitors to run a malicious Windows Installer command, delivering the Psychedelic information stealer. The malware reportedly targets browser passwords, account tokens, and cryptocurrency-wallet data, establishes persistence, and communicates with a command-and-control server. RealGround analysis: this is conventional malware and social engineering rather than an AI-specific threat, so its direct relevance to the permitted AI risk categories is limited; the closest fit is malicious AI use because the campaign uses automated deception and malware delivery techniques, while readiness assessment and red teaming could help evaluate exposure to similar abuse.