> TritonInfoSec News
Home / Sep 25, 2026 / Story
0
#9 The Hacker News general September 24, 2026 at 14:29 UTC

Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer

By [email protected] (The Hacker News)

AI Summary

An active ClickFix campaign is compromising legitimate Ukrainian business websites to inject fake Cloudflare verification pages, tricking visitors into running a Windows Installer command that deploys a previously undocumented information stealer named Psychedelic. The attack uses clipboard injection to execute the payload without file downloads, evading many traditional defenses. Security teams should update detections for clipboard-based PowerShell/msiexec lures targeting Eastern European infrastructure.

Read full article → https://thehackernews.com/2026/09/hacked-ukrainian…

Relevance score: 77.0/100

# More from September 25

  1. 1
    There's a new way to break RSA that's faster than anything we've seen before Ars Technica Security
  2. 2
    Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure The Hacker News
  3. 3
    OpenAI hacked Australian Medicare govt site, probed data providers BleepingComputer
  4. 4
    CISA: Ransomware gangs now exploiting critical TeamCity flaw BleepingComputer
  5. 5
    Digital forensics firm with US federal contracts covered up ties to Russia, DOJ alleges The Record
  6. 6
    Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content The Hacker News
  7. 7
    Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry The Hacker News
  8. 8
    A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You The Hacker News
  9. 10
    Lawmakers introduce bill for voluntary telecom cyber rules after Salt Typhoon hacks The Record