That Fake Cloudflare CAPTCHA Is Copying msiexec Into Your Clipboard

you land on a Ukrainian business site you have used before. a Cloudflare verification page appears in Ukrainian. you click. nothing downloads. nothing pops. then the page politely asks you to press Win+R and paste. what just landed on your clipboard is not a verification token. it is an msiexec command that pulls a package named something like elita.msi, and that package drops Psychedelic Stealer. Arctic Wolf Labs has the receipts. your browser passwords, session tokens, and crypto wallets are the prize.

why ClickFix keeps working

email gateways are pretty good at stopping weird attachments. browser isolation is pretty good at containing drive-by downloads. ClickFix sidesteps both by making the human the installer. the page never serves a binary to the browser. it serves instructions. the binary arrives when the user pastes a “verification” command into Win+R, which is a path most enterprise controls treat as a power user being productive.

the fake Cloudflare branding does the social work. people have been trained for years to complete bot checks. a CAPTCHA that speaks your language on a site you already trust is not a red flag for most humans. it is Tuesday.

the infection chain, compressed

1. attacker compromises a real Ukrainian business website (or buys traffic to one).
2. an iframe injects a Ukrainian fake Cloudflare verification page.
3. user interaction copies an msiexec / installer command to the clipboard.
4. the page tells the user to open Win+R and paste.
5. the MSI (elita.msi in the observed samples) drops Psychedelic Stealer.
6. stealer grabs browser creds, tokens, wallets; sets a scheduled task; phones home.

Arctic Wolf notes the panel measures lure interaction, not confirmed malware execution. that is an important distinction for metrics and a useless distinction for the people who pasted the command. if you ran it, assume the stealer ran too.

the tells, for humans and for defenders

• a Cloudflare-looking page that asks you to use Win+R or paste into a system dialog. real Cloudflare challenges do not do that.
• clipboard contents that start with msiexec, powershell, cmd, or a curl-to-pipe one-liner after you clicked a “verify” button.
• new scheduled tasks created shortly after a browser session on a rarely visited business site.
• outbound connections from a fresh MSI-installed binary to infrastructure that is not Microsoft, not Cloudflare, and not your software vendor.

what to do if you already pasted it

1. disconnect the machine from the network.
2. from a clean device, change passwords for every account that browser could reach, starting with email, banking, and cloud consoles. revoke sessions.
3. assume crypto wallets on that box are burned. move funds from a clean device only.
4. reimage the workstation. scheduled-task persistence plus a stealer is not a “run malwarebytes and hope” situation.
5. report it: FTC ReportFraud, IC3, and your national CSIRT. if you are in Ukraine or dealing with Ukrainian business sites, flag it to the relevant CERT.

what orgs should push this week

block the known MSI hashes and C2 once your intel feed has them. more importantly, train the Win+R paste moment. “a website asked me to paste something into Run” should be a reported phishing event, not a completed helpdesk ticket. browser isolation and reducing local admin rights help. so does treating compromised-looking CAPTCHA overlays on otherwise normal sites as a web compromise, not a user training failure alone.

Psychedelic Stealer is not a new idea. it is ClickFix with better localization and a stealer that knows where the wallets live. the fix is still the same boring advice: never paste a CAPTCHA into Win+R, and treat any site that asks you to as hostile until proven otherwise.

if your users are one pasted CAPTCHA away from a stealer, tighten the human layer before the next panel goes live. Book a slot with Dark Edge Consulting.