OTX Threat: The Psychedelic Stealer: When a CAPTCHA Becomes an Installer

Arctic Wolf Labs is tracking an ongoing campaign that compromises legitimate Ukrainian business websites and uses injected iframes to display a Ukrainian-language fake Cloudflare verification page. When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the Windows Run dialog. The command retrieves an MSI packa CVEs: CVE-2026-85102, CVE-2026-85103, CVE-2026-84869, CVE-2026-76461