Threats Tagged 'psychedelic'

Between September 9 and 14, 2026, a Russian-speaking threat actor compromised at least six legitimate Ukrainian small-business websites to deliver a fake Cloudflare verification page. This social engineering campaign, known as the ClickFix chain, tricked victims into manually executing msiexec.exe commands, resulting in 79 infections from 426 clicks. The malware, named Psychedelic, steals browser credentials, session tokens, and cryptocurrency wallet data from multiple wallets including MetaMask and Trust Wallet. It establishes persistence via browser extensions with native-messaging bridges, scheduled tasks, and communicates with a REST API for additional commands. The attack deliberately avoids encoded PowerShell and uses signed Microsoft binaries to evade detection. The targeting is focused on Ukraine with clear financial motives.

MediumMalwareUkraine#cryptocurrency theft#fake captcha#native-messaging bridge

CVE-2026-85102 is a critical vulnerability in Checkpoint Quantum Security Gateway involving improper certificate validation (CWE-295). Arctic Wolf Labs reports an ongoing campaign targeting legitimate Ukrainian business websites by injecting iframes that display a fake Cloudflare verification page in Ukrainian. Visitors are tricked into copying and running a Windows Installer command that downloads an MSI package delivering a previously unknown infostealer malware tagged 'Psychedelic'. This vulnerability has a CVSS score of 9.8, indicating high severity with remote exploitation possible without user interaction.

CriticalVulnerabilityUkraineUnited States#cve#cve-2026-85102#cwe-295