security2 publishers
Compromised Ukrainian business sites are serving a ClickFix lure that installs through msiexec
Arctic Wolf Labs found injected iframes on real Ukrainian business sites showing a Ukrainian-language fake Cloudflare check that copies a Windows Installer command for the visitor to paste into Run. Its exposed panel logged 557 views.
Reality
- Evidence70
- Adoption42
- Hype gap+5
- Incentives62
- Confidence66