The Psychedelic Stealer: When a CAPTCHA Becomes an Installer

Reported 25 Sep 2026 by otx · Severity: medium

Arctic Wolf Labs is tracking an ongoing campaign that compromises legitimate Ukrainian business websites and uses injected iframes to display a Ukrainian-language fake Cloudflare verification page. When a visitor interacts with the page, the lure copies a Windows Installer comman