Compromised Ukrainian business sites are serving a ClickFix lure that installs through msiexec

The panel decides how big this campaign looks, and it is the piece most easily over-read. It held per-domain command configuration, so an operator could set which command each compromised site copied to a visitor's clipboard ^[5]. It also counted views, clicks and completions. Arctic Wolf Labs wrote that those events "do not independently confirm malware execution or successful compromise" ^[7].

Outside Ukraine the counts are thin. 557 views with 446 assigned to Ukraine leaves 111 for the other 31 countries, an average of about 3.6 views each, and Ukraine accounts for roughly 80 percent of everything the panel logged ^[6][8].

Delivery is what separates this from mass-mailed ClickFix. Arctic Wolf found lures on sites belonging to a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller and publisher, a psychological facility, a tool retailer and an automotive retailer ^[9]. Established social media accounts and backlinks from third-party business listings supported its assessment that those domains belonged to real operating businesses ^[10]. The injected script, once deobfuscated, referenced fsputnik[.]com/tds/tracker.js ^[11]. WHOIS puts the registration of uasputnik[.]com at September 9, 2026, 17:02:25 UTC ^[13].

A blocklist built on unfamiliar-looking hosts does not help here, because the page the visitor trusts is the clinic's own and the traffic is the clinic's existing traffic ^[1]. When the visitor selects "Done," the lure posts a bp-reload-parent message to the parent origin so the compromised host page reloads ^[12].

The lure is Ukrainian-language and the traffic panel behind it is Russian-branded ^[14]. A /tds/ path, per-domain command configs and view telemetry describe a configurable traffic distribution setup serving several compromised domains at once ^[5][11].

Execution turns on two user-side steps. The clipboard carries an msiexec command instead of the encoded PowerShell one-liner most ClickFix chains use ^[3], so the process that reaches out for the payload is Windows Installer requesting a remote package ^[2]. Either step breaks the chain: removing the Run dialog from standard users, or refusing user-context installs of remote MSI packages ^[15]. What lands if both hold is an implant that takes browser passwords, account tokens and wallet data, writes a scheduled task, and polls its C2 for more work ^[4].