The attacker's dashboard calls these 79 events executions. The researchers who found it refuse the word
Arctic Wolf Labs recovered the lure management panel behind a ClickFix campaign on compromised Ukrainian business sites. It recorded 557 views, 426 clicks and 79 completions, and not one of those numbers establishes that anything ran.
By Parminder Kumar Sharma · · 8 min read
Three numbers, and what each one is worth
Arctic Wolf Labs published an analysis on 24 September 2026 of a campaign that injected an iframe into legitimate Ukrainian business websites, a hair treatment clinic, a scale model manufacturer, a bookseller, a psychological facility, a tool retailer and a car dealer among them. The iframe loads a Ukrainian language page imitating a Cloudflare verification screen, which copies a Windows Installer command to the clipboard and tells the visitor to paste it into the Windows Run box.
The researchers also found the operators' own lure management panel, exposed. At the time it was read it recorded 557 views, 426 clicks and 79 completions across 32 countries, with 446, 351 and 71 of those assigned to Ukraine.
The panel labels the completions executions and divides them by views to produce a conversion rate. Arctic Wolf's report declines to use the word, and says why in a sentence that is worth more than the rest of the telemetry: a completion "measures progression through the web interface only".
What that does not establish, and here the source has done the work for us. A view does not establish a unique human visitor. A click does not establish that the clipboard write succeeded, and the page's own code fires the beacon and the clipboard helper in sequence without checking either. A completion does not establish that the visitor opened the Run box, pasted anything, that the installer ran, that the payload landed, or that a host was compromised. The researchers state each of those limits explicitly and then hold to them for the rest of the report, including in a table titled with what each event does not establish.
So the honest reading of 79 is this: 79 times, somebody clicked a button that had been deliberately disabled for 35 seconds.
A page that performs the verification it is imitating
The lure is worth describing precisely, because every element of it is a signifier of checking that checks nothing.
The footer displays a randomly generated Ray ID. Cloudflare assigns a real Ray ID to every request that passes through its network, so the format is familiar to anyone who has ever hit an interstitial. Here it is generated on the page and means nothing. The agreement text carries a fixed visitor identifier, the same value for every visitor. Then the sequence: click the container, and the page shows a spinner for three seconds, then an instruction dialog, then keeps the Done button disabled for about 35 more seconds.
The report is blunt about what that delay is for. It "does not verify that the visitor opened Windows Run, pasted the command, or installed the payload". It controls progression through the interface. It exists to make the user wait as though something were being checked, which is exactly the experience a genuine verification interstitial provides, and for the same reason: waiting is what makes a check feel like a check.
One more detail deserves attention from anyone writing detections. The clipboard command invokes Windows Installer directly rather than an encoded PowerShell one liner, with an unattended interface, and it carries a property whose value is the Ukrainian text for "I confirm that I am not a robot", so the pretext continues into the Windows execution step. Arctic Wolf notes the consequence in one line: detections limited to encoded PowerShell miss this.
What the numbers do support, computed carefully
Take the panel's counts as what they are, a record of interface progress, and one comparison inside them is still informative, because it holds the interface constant and varies only the audience.
The lure is written in Ukrainian and served from compromised Ukrainian business sites. Ukrainian visitors saw a page in their language on a site they may already have trusted. Everyone else saw a page in a language most of them do not read.
Computed from the country table in Arctic Wolf Labs' report of 24 September 2026. Percentages and the non-Ukraine row are ours.
| Audience | Views, clicks, completions | Completions per 100 views |
|---|---|---|
| Ukraine | 446, 351, 71 | 15.9 |
| Everywhere else, 31 countries | 111, 75, 8 | 7.2 |
| All recorded traffic | 557, 426, 79 | 14.2 |
Ukrainian visitors reached the end of the interface at 2.2 times the rate of everyone else. Ukraine supplied 80.1 per cent of views but 89.9 per cent of completions.
And here is the caveat that has to travel with that number. The non-Ukraine figure rests on eight completions. Eight. A sample that small can move a percentage point with a single event, and the comparison is suggestive rather than demonstrated. It is also exactly the kind of number that gets quoted onward without its denominator, which is why it is written out here in full.
What survives the caveat is the ordering, not the multiple. A localised lure on a trusted local site converted better than the same lure shown to people it was not written for. That is unsurprising, and it is the part of this campaign that costs the operators almost nothing to replicate anywhere else.
What actually arrives, when it arrives
The implant is called Psychedelic Stealer after a tag embedded in the binary. Arctic Wolf is careful here too: it does not assign the malware to a known family and does not attribute the operation to a known group.
It targets saved passwords in Chromium based browsers, account tokens from the browser's own data store, and cryptocurrency wallets in two distinct places, browser extension storage and locally installed desktop wallet applications. It profiles the host thoroughly, from processor and memory to antivirus and installed browsers. It creates a logon scheduled task for persistence. And it polls a command and control server for tasks, downloading and running further files in several formats, which means the stealer is also an entry point rather than an end state.
The report applies the same discipline to its own findings that it applied to the panel's. On the token theft: the presence of token collection logic "does not establish session hijacking or account takeover", because whether a stolen token is useful depends on its type, validity, destination and the controls around it, and no account takeover was observed. That is a vendor writing down the limits of its own evidence in a report that is also marketing, and it deserves saying.
What to do about it
Take this with you
In the order worth doing
- Check whether your detection content treats Windows Installer invoked from the Run box as an execution event. This chain never touches encoded PowerShell, which is where most clipboard-paste detections are pointed.
- Alert on the Run box itself. A command typed or pasted into Windows Run that fetches a remote installer is close to unheard of in normal use and is the one step this entire technique cannot avoid.
- Tell users the specific thing, not the general thing. A real verification page never asks you to press Windows and R, and never asks you to paste anything. That single rule defeats the whole class without requiring anyone to spot a fake.
- If you run a public facing site, treat injected third party iframes as a tier one integrity problem. In this campaign the compromised businesses were the delivery mechanism and their customers were the victims.
- When you read any campaign telemetry, including your own, write down what each counter measures rather than what it is named. A dashboard that labels interface events as executions will be quoted as executions.
- For the accounts that matter, assume a stolen browser token is a live session until the session is invalidated. Rotating a password does not end a session that was already open.
The question this leaves
Arctic Wolf sells managed detection and response and the report says so at the end, in the usual place. It is also one of the more carefully written pieces of threat research published this month, and the care shows in exactly the place where a vendor has the most to gain from carelessness: it had a number, 79, sitting in a field labelled executions, and it refused to call it that.
The campaign and the report are the same lesson from opposite directions. The lure is a machine for manufacturing the appearance of verification: an identifier that identifies nothing, a delay that checks nothing, a button that confirms nothing. The panel behind it is a machine for manufacturing the appearance of measurement: an event named for an outcome it cannot see.
So the question, and it applies to your reporting as much as to theirs: how many of the numbers you present each month are named after things you observed, and how many are named after things you inferred from an event that happened to be easy to count?
Sources
- PrimaryThe Psychedelic Stealer analysis of 24 September 2026, read in full, used for the telemetry table, the lure interface behaviour, the delivery chain and the stated limitationsArctic Wolf Labsaccessed 2026-09-25
- PrimaryCloudflare's own documentation for what a Ray ID is, used to show what the identifier on the fake page imitates and what it would mean if genuineCloudflareaccessed 2026-09-25
- Reported byCoverage of the same research, used only to date the wider reportingThe Hacker Newsaccessed 2026-09-25
