OTX Threat: The Psychedelic Stealer: When the CAPTCHA Is the Installer

Between September 9 and September 14, 2026, an unattributed Russian-speaking operator compromised at least six legitimate Ukrainian small-business websites to deliver a fake Cloudflare verification page. The ClickFix chain convinced victims to manually execute msiexec.exe commands via the Windows Run dialog, achieving a 14 percent completion rate (79 infections from 426 clicks). The payload, inter Sectors: Healthcare, Manufacturing, Media