A new malware campaign is exploiting legitimate business websites in Ukraine to distribute a previously unidentified information stealer, highlighting an evolution in social engineering tactics that security teams must address.
According to a report from The Hacker News on September 28, attackers have compromised Ukrainian business sites to host fraudulent Cloudflare verification pages. Visitors are tricked into installing a novel malware named "Psychedelic." The campaign operates through a "ClickFix" method, which represents a significant shift from traditional phishing. Rather than passively harvesting credentials, this technique actively engages the victim in the attack's execution.
Upon visiting an infected site, the user sees a fake Cloudflare challenge. The page then instructs them to paste a provided command into a Windows command prompt to "prove they are human." This action copies a malicious Windows Installer command to the clipboard and executes it. This interactive process helps evade many automated security scanners, placing the final burden of execution on the user.
The use of compromised legitimate domains is a key factor in the campaign's effectiveness. As noted in the source analysis, this approach allows the malicious content to bypass standard domain reputation filters and enhances its apparent legitimacy. For defenders, this creates a critical vulnerability, as traditional allowlists and reputation-based defenses are ineffective when trusted websites are weaponized.
Once installed, the Psychedelic stealer begins a broad data-harvesting operation. It is designed to steal saved browser passwords and cookies, cryptocurrency wallet information, and active session tokens. The focus on session tokens is particularly dangerous, as it allows attackers to hijack authenticated sessions without needing to crack passwords.
The emergence of this threat underscores the need for a more advanced defensive strategy. Organizations should enhance user training to cover interactive social engineering tactics like ClickFix, where users are coached into performing technical steps. Endpoint Detection and Response (EDR) solutions must be tuned to monitor for suspicious clipboard activity and unauthorized installer executions. Additionally, website administrators should implement integrity monitoring to detect and respond to compromises rapidly.
This campaign serves as a practical case study for IT professionals, demonstrating that attackers are moving beyond simple lures and blending technical exploitation with sophisticated psychological manipulation. Effective defense requires adapting both technical controls and user education to recognize and thwart this emerging class of interactive attacks. No threat actor has been publicly attributed to the campaign.
一場新的惡意軟件活動正利用烏克蘭的合法商業網站來散播一種此前未被識別的資訊竊取器，突顯了社會工程戰術的演變，這是安全團隊必須應對的問題。
根據《The Hacker News》9月28日的報導，攻擊者已入侵烏克蘭商業網站，用以託管假冒的 Cloudflare 驗證頁面。訪客被誘騙安裝一種名為「Psychedelic」的新型惡意軟件。該活動透過「ClickFix」方式運作，與傳統網絡釣魚有顯著差別。此技術並非被動收集憑證，而是主動引導受害者參與攻擊的執行過程。
當用戶訪問受感染的網站時，會看到假的 Cloudflare 挑戰頁面。頁面隨後指示他們將一段提供的命令貼到 Windows 命令提示字元中，以「證明自己是人類」。此操作會將一個惡意的 Windows Installer 命令複製到剪貼簿並執行。這個互動過程有助於規避多數自動化安全掃描器，並將最終的執行責任轉嫁給用戶。
使用遭入侵的合法網域是此活動有效的關鍵因素。如分析來源所述，這種方法允許惡意內容繞過標準的網域信譽過濾器，並增強其表面的合法性。對防禦者而言，這創造了一個關鍵弱點，因為當受信任的網站被武器化時，傳統的白名單和基於信譽的防禦措施將變得無效。
一旦安裝，Psychedelic 竊取器便開始進行大規模的資料擷取操作。它被設計用來竊取已儲存的瀏覽器密碼和 Cookie、加密貨幣錢包資訊，以及活躍的會話令牌。特別危險的是對會話令牌的關注，因為它允許攻擊者無需破解密碼即可劫持已驗證的會話。
此威脅的出現突顯了採用更先進防禦策略的必要性。組織應加強用戶培訓，涵蓋 ClickFix 等互動式社會工程戰術，在這些戰術中用戶會被指導執行技術步驟。端點偵測與回應（EDR）解決方案必須調整以監控可疑的剪貼簿活動和未授權的安裝程式執行。此外，網站管理員應實施完整性監控，以快速偵測並應對入侵事件。
這場活動為 IT 專業人員提供了一個實際案例研究，表明攻擊者正超越簡單的誘餌，將技術利用與複雜的心理操縱相結合。有效的防禦需要調整技術控制措施和用戶教育，以識別並挫敗這種新興的互動式攻擊類別。目前尚未有任何威脅行為者被公開歸因於此活動。