Russian Operators Target Ukrainian Businesses with Fake Cloudflare Lures

KYIV — Russian cyber operators have compromised a network of Ukrainian business websites to distribute Psychedelic Stealer malware, utilizing deceptive pop-ups that mimic legitimate Cloudflare security alerts. The campaign, detected on Sept. 24, 2026, marks a significant escalation in targeted infrastructure attacks aimed at harvesting sensitive financial and authentication data from corporate entities.

The attack vector relies on the defacement of compromised websites to serve fake "ClickFix" prompts. These lures are designed to resemble standard Cloudflare challenge pages, which typically appear when a site detects unusual traffic patterns or requires user verification. When Ukrainian business owners or employees encounter these fraudulent alerts, clicking the prompt triggers the download and execution of the Psychedelic Stealer payload.

Once installed on victim systems, the malware is configured to extract browser-stored passwords, session tokens, and cryptocurrency wallet data. Security analysts indicate that the operators also seek to establish long-term persistence on infected machines, allowing for continued access and potential lateral movement within corporate networks. The theft of account tokens poses an immediate risk of unauthorized access to email accounts, cloud storage, and financial platforms without requiring additional user interaction.

The targeting of Ukrainian business infrastructure aligns with broader patterns of state-sponsored cyber espionage and disruption observed throughout the region. By exploiting trusted brand identities like Cloudflare, the attackers increase the likelihood of successful social engineering, as users are conditioned to trust such security prompts. The compromised websites serve as a silent distribution channel, reaching victims who have no reason to suspect their browsing environment is hostile.

Ukrainian cybersecurity officials have begun coordinating with private sector partners to identify and remediate infected systems. However, the speed at which the malware propagates through the compromised web infrastructure suggests that many organizations may remain unaware of the breach until financial losses or data exfiltration are confirmed. The specific list of targeted industries remains under investigation, though initial indicators suggest a focus on logistics, energy, and financial services sectors.

Questions remain regarding the full scope of the operation and whether the compromised sites were part of a larger supply chain attack. It is unclear how many distinct Ukrainian domains have been hijacked to serve the malicious lures or if the campaign has expanded beyond national borders. As defenders work to patch vulnerabilities and clean infected networks, the potential for further data theft persists until the root access on the compromised servers is fully neutralized.