ClickFix Campaign on Hacked Ukrainian Sites Drops Psychedelic Stealer via Fake Cloudflare Pages — Detection and Defense Guide

---
title: ClickFix - Msiexec Remote Package Install via Interactive Shell
id: 3f8a2b71-4c6d-4e59-9a01-7b2c8d4e5f60
status: experimental
description: Detects msiexec.exe executed with a remote URL package source and quiet flags, parented by explorer.exe — consistent with ClickFix lures that instruct users to paste a Windows Installer command into the Run dialog. Observed delivering the Psychedelic information stealer via fake Cloudflare verification pages on compromised Ukrainian sites.
references:
  - https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html
  - https://attack.mitre.org/techniques/T1218/007/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1218.007
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\msiexec.exe'
  selection_url:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_img and selection_url and selection_parent
falsepositives:
  - Rare administrative ad-hoc installs from a URL pasted into the Run dialog
  - Some enterprise software updaters (typically parented by a service, not explorer)
level: high
---
title: ClickFix - Quiet Msiexec Installation of Remote MSI Package
id: 8c1d5e92-2a7f-4b38-bd64-9e3f1a6c7d08
status: experimental
description: Detects msiexec installing an MSI package from a remote URL with silent/quiet switches (/qn, /quiet, /passive), a hallmark of ClickFix clipboard-pasted commands such as those used in the Psychedelic stealer campaign. Catches executions even when the parent process is obscured.
references:
  - https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html
  - https://attack.mitre.org/techniques/T1218/007/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1218.007
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\msiexec.exe'
  selection_url:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  selection_quiet:
    CommandLine|contains:
      - '/qn'
      - '/quiet'
      - '/passive'
      - '-qn'
      - '-quiet'
  condition: selection_img and selection_url and selection_quiet
falsepositives:
  - Centrally managed software distribution using quiet switches (investigate parent process and URL reputation)
level: high
---
title: Msiexec Embedded HTTP Connection to Non-Standard Host
id: 5e7b3c41-9d2a-4f68-8c13-2b6d9a4e1f75
status: experimental
description: Detects the Windows Installer process establishing outbound network connections. Msiexec network activity is expected only during remote package retrieval and is a strong corroborating signal for ClickFix-delivered MSI payloads such as the Psychedelic stealer.
references:
  - https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html
  - https://attack.mitre.org/techniques/T1218/007/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.command_and_control
  - attack.t1218.007
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\msiexec.exe'
  filter_cdn:
    DestinationHostname|contains:
      - 'microsoft.com'
      - 'windowsupdate.com'
      - 'digicert.com'
  condition: selection and not filter_cdn
falsepositives:
  - Legitimate MSI installations from vendor URLs (tune with an allowlist of approved software distribution domains)
level: medium

// Hunt 1: Interactive msiexec with remote URL - ClickFix Run-dialog pattern
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "msiexec.exe"
| where ProcessCommandLine has_any ("http://", "https://")
| where InitiatingProcessFileName in~ ("explorer.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "msedge.exe", "chrome.exe", "firefox.exe")
| project TimeGenerated, DeviceName, AccountName,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, SHA256, ReportId
| sort by TimeGenerated desc;

// Hunt 2: Quiet remote MSI installation regardless of parent process
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "msiexec.exe"
| where ProcessCommandLine has_any ("http://", "https://")
| where ProcessCommandLine has_any ("/qn", "/quiet", "/passive", "-qn", "-quiet")
| project TimeGenerated, DeviceName, AccountName,
    InitiatingProcessFileName, ProcessCommandLine, SHA256, ReportId
| sort by TimeGenerated desc;

// Hunt 3: Correlate msiexec URL installs with outbound connections (C2 / payload staging)
let MsiEvents = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "msiexec.exe"
| where ProcessCommandLine has_any ("http://", "https://")
| project DeviceName, AccountName, ProcessCommandLine, ProcTime=TimeGenerated, DeviceId;
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "msiexec.exe"
| join kind=inner MsiEvents on DeviceId
| project ProcTime, DeviceName, AccountName, ProcessCommandLine,
    RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName
| sort by ProcTime desc;

-- ClickFix / Psychedelic stealer triage:
-- msiexec processes with remote URL arguments and recently staged MSI files
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'msiexec'
  AND CommandLine =~ 'https?://'

-- Separately, hunt for recently created MSI payloads in user/temp paths
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Temp/*.msi',
  'C:/Users/*/Downloads/*.msi',
  'C:/Windows/Temp/*.msi'
])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

# ClickFix / Psychedelic Stealer - Triage and Hardening Script
# Security Arsenal - run elevated

Write-Host "=== [1] Hunting MsiInstaller events referencing remote URLs (last 14 days) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='MsiInstaller'; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'https?://' } |
  Select-Object TimeCreated, Id, Message |
  Format-List

Write-Host "=== [2] Recent process executions: msiexec with URL arguments (Security 4688) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'msiexec' -and $_.Message -match 'https?://' } |
  Select-Object TimeCreated, Message |
  Format-List

Write-Host "=== [3] Recently created MSI files in user/temp staging paths (last 14 days) ===" -ForegroundColor Cyan
$paths = @("$env:TEMP", "$env:USERPROFILE\Downloads", "C:\Windows\Temp")
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Filter *.msi -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Select-Object FullName, LastWriteTime, Length
}

Write-Host "=== [4] Defender ASR rule posture (relevant rules) ===" -ForegroundColor Cyan
# e6db77e5-3df2-4cf1-b95a-636979351e5b = Block persistence through WMI event subscription
# d1e49aac-8f56-4280-b9ba-993a6d77406c = Block process creations from PSExec/WMI
# 56a863a9-875e-4185-98a7-b882c64b5ce5 = Block abuse of exploited vulnerable signed drivers
# Key: 0=Disabled, 1=Block, 2=Audit, 6=Warn
$asrIds = @('56a863a9-875e-4185-98a7-b882c64b5ce5','d1e49aac-8f56-4280-b9ba-993a6d77406c','e6db77e5-3df2-4cf1-b95a-636979351e5b')
$prefs = Get-MpPreference
for ($i=0; $i -lt $prefs.AttackSurfaceReductionRules_Ids.Count; $i++) {
  if ($asrIds -contains $prefs.AttackSurfaceReductionRules_Ids[$i]) {
    Write-Host ("{0} => Action {1}" -f $prefs.AttackSurfaceReductionRules_Ids[$i], $prefs.AttackSurfaceReductionRules_Actions[$i])
  }
}

Write-Host "=== [5] Enable SmartScreen + network protection (ClickFix lure mitigation) ===" -ForegroundColor Cyan
Set-MpPreference -EnableNetworkProtection Enabled
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Force -ErrorAction SilentlyContinue | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name 'EnableSmartScreen' -Value 1 -Force
Write-Host "Done. Investigate any hits from sections 1-3 as potential credential compromise." -ForegroundColor Green