What happened
An active campaign has compromised legitimate Ukrainian business websites by injecting fake Cloudflare verification pages. These malicious pages serve as lures to Victims, enticing them to interact, which triggers the delivery of a previously undocumented information stealer known as Psychedelic. The attack leverages website compromise to distribute malware, specifically targeting Microsoft Windows systems. When a victim interacts with the fake verification page, a Windows Installer command is copied to the clipboard, prompting them to manually paste it, potentially resulting in the download and installation of the stealer. The campaign’s behaviour suggests an intent to harvest data or credentials from affected systems, although detailed capabilities of Psychedelic remain under investigation. The attack’s overall severity is considered medium due to its reliance on website compromise and malware delivery without evidence of widespread or zero-day vulnerabilities being exploited.
Who is affected
Organisations running Ukrainian business websites that have been compromised may be affected. The attack primarily targets Microsoft Windows systems, which may be impacted if victims execute the malicious installer. The scope of affected entities is limited to those hosting or operating websites that have been hijacked to serve the fake Cloudflare pages. As the attack involves compromised third-party websites, any visitors or users of those sites could be at risk of malware infection and potential data compromise. There is no current indication of the attack being targeted at specific sectors beyond general Ukrainian business activities or requiring specific technical configurations outside standard Windows environments.
Recommended actions
- Verify the integrity of website hosting environments and eliminate the presence of injected malicious pages or scripts.
- Strengthen server security, including access controls, to prevent unauthorised modifications to web content.
- Implement network monitoring to detect suspicious outbound traffic or command execution indicative of malware activity.
- Educate internal staff and website administrators on the signs of website compromise and proper incident response procedures.
- Encourage users to exercise caution when prompted to paste commands or run installers originating from suspicious sources, especially after visiting compromised websites.
Indicators of compromise
Indicators of compromise are not yet available for this campaign.
