Ukrainian Sites Hijacked to Deploy Fake Cloudflare Lures

Introduction

The digital threat landscape is constantly shifting, and a new campaign has surfaced that compromises legitimate Ukrainian business websites. By hijacking these domains, attackers insert counterfeit Cloudflare verification screens that masquerade as genuine security checks. The ruse convinces visitors to copy a Windows command from the clipboard and execute it, which silently drops a covert information‑stealing payload named Psychedelic. This novel approach blends social engineering with supply‑chain compromise to harvest sensitive data, illustrating how attackers exploit trust in well‑known security services to bypass user vigilance. The campaign leverages the reputation of Cloudflare, a service widely used for website acceleration and DDoS protection, to create a false sense of legitimacy. Victims, believing they are completing a routine verification, inadvertently execute a PowerShell command that pulls down the malicious installer. This technique has been observed in other recent attacks, indicating a broader trend of abusing trusted platforms for stealthy intrusion.

The ClickFix Campaign Unveiled

Security researchers have identified an active ClickFix operation that specifically targets Ukrainian business websites. The initial compromise often occurs via vulnerable content management systems, outdated plugins, or weak administrative credentials, allowing the attackers to inject malicious JavaScript directly into the page’s HTML. The injected script is heavily obfuscated, making static analysis difficult, and it dynamically generates a counterfeit Cloudflare verification overlay that closely resembles the official “Checking your browser” message. This fake overlay is styled with the recognizable Cloudflare branding and a loading indicator, creating a convincing illusion of a legitimate security check. When a visitor interacts with the page, the script captures the clipboard content and injects a command that looks like a routine system instruction. The command, typically a PowerShell or cmd.exe line, is presented as something the user should copy and paste into a terminal. Unbeknownst to the visitor, this command silently executes a Windows Installer sequence that downloads the Psychedelic stealer from a remote server. The stealer, which remains undocumented in public threat feeds, is capable of harvesting browser cookies, saved passwords, system credentials, and even taking periodic screenshots. Its communications are encrypted and routed through a domain‑generation algorithm, making detection by conventional network monitoring tools challenging. The overarching objective of the campaign is to siphon sensitive corporate data—including login credentials, financial records, and internal documents—so that the stolen information can be leveraged for further exploitation, credential stuffing, or ransomware deployment.

• The attack leverages trusted Cloudflare branding to lower victim suspicion.
• It exploits the common practice of copying clipboard commands from web instructions.
• Psychedelic operates stealthily, remaining hidden from standard antivirus scans.
• Victims are typically unaware until their data appears in downstream fraud or ransomware incidents.

How the Fake Cloudflare Lure Operates

Upon visiting the compromised page, the malicious JavaScript captures whatever text resides in the user’s clipboard and then injects a line that appears to be a benign system command. The instruction typically reads something like powershell -ExecutionPolicy Bypass -Command ... and is displayed in a pop‑up or inline prompt, urging the visitor to copy it and paste into a command line. Once the user complies, the command launches a lightweight Windows Installer package that silently downloads a compact executable from a covert HTTPS endpoint. This executable establishes a persistent connection to the attacker’s command‑and‑control server, often using a domain generated on the fly to evade blacklists. The payload then begins enumerating the victim’s browser profile, extracting stored cookies, autofill data, and saved passwords, as well as system environment variables and installed application lists. In addition to credential theft, the stealer can capture screenshots at regular intervals and harvest clipboard contents beyond the initial command, providing the attacker with a broader view of the victim’s activity. All harvested data is encrypted locally before being exfiltrated through the same HTTPS channel, often masquerading as ordinary web traffic to avoid detection.

1. The fake Cloudflare screen mimics a legitimate security check, creating a false sense of trust.
2. Clipboard hijacking tricks the user into executing a PowerShell or cmd instruction.
3. The downloaded payload runs silently, establishing persistence and data collection.
4. Stolen information is exfiltrated via encrypted channels, often masquerading as normal traffic.

Strategic Impact and Defensive Measures

For Ukrainian firms and any organization with an online presence, this campaign underscores the risk of client‑side compromise. Even if the web server is secure, the end‑user device can be exposed through simple social engineering. The stealthy nature of Psychedelic makes detection difficult, allowing attackers to operate over extended periods. Enterprises should therefore adopt a multi‑layered defense: enforce web‑application firewalls that block suspicious script injections, deploy browser‑based content security policies, and educate staff about the dangers of copying commands from unverified web pages. Additional steps include regular endpoint monitoring, timely patching of operating systems, and employing threat‑intelligence feeds that flag known ClickFix activity. By integrating AI‑driven anomaly detection with traditional security controls, organizations can spot the subtle indicators of this and similar campaigns before significant damage occurs.

• Implement strict content‑security‑policy (CSP) headers to restrict unauthorized script execution.
• Use DNS‑based filtering to block known malicious domains associated with ClickFix.
• Conduct regular phishing and social‑engineering simulations to reinforce safe clipboard practices.
• Deploy endpoint detection and response (EDR) solutions that monitor for unusual PowerShell activity.

Conclusion

In an era where digital trust is paramount, the recent ClickFix operation against Ukrainian sites serves as a stark reminder that visual legitimacy does not guarantee safety. Organizations must move beyond perimeter defenses and embed continuous, intelligent monitoring into their security fabric. Grivyonx Cloud’s AI‑powered automation and comprehensive cyber‑intelligence platform enable rapid detection of such supply‑chain manipulations, helping protect both data integrity and business continuity without resorting to aggressive sales tactics.