MUST READ

ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer

 | 

AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway

 | 

U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog

 | 

Ryuk Member Karen Vardanyan Sentenced to Two Years in U.S. Prison

 | 

AI Helps Uncover MikroTrick Attack Chain in MikroTik RouterOS

 | 

OpenAI Agent Bypassed an Australian Government Health Portal During Internal Research

 | 

CLOSEDQUORUM, the malware that asks four AI models what to do next

 | 

U.S. CISA adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog

 | 

F5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks

 | 

ShinyHunters claims FBI breach after alleged PeopleSoft zero-day attack

 | 

EvilTokens made phishing-as-a-service look easy. Then it got taken down

 | 

Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools

 | 

CVE-2026-87902: how close is your WordPress to remote code execution?

 | 

Check Point Fixes a New Actively Exploited Critical Security Flaw

 | 

Chaotic Eclipse Released BigDiskBuster, A PoC For Windows Defender Update DoS Zero-Day

 | 

Public PoC Exposes Critical Veeam Agent Privilege Escalation

 | 

U.S. CISA adds Zyxel flaw to its Known Exploited Vulnerabilities catalog

 | 

Contagious Interview: 30,000 devices infected by a fake job interview

 | 

Google Fined €403 Million Over Location Data Practices

 | 

Foreign Hackers Target Two Colorado Water Utilities

 | 

Cloudflare CAPTCHA

Pierluigi Paganini September 25, 2026
ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer

Attackers hijacked Ukrainian websites to deliver a fake Cloudflare CAPTCHA that installs Psychedelic Stealer and steals browser and crypto credentials. Psychedelic Stealer is being distributed through compromised Ukrainian business websites. Attackers injected hidden iframes into legitimate pages and used them to display a fake Cloudflare verification screen to visitors. The affected sites included a hair-treatment […]

newsletter

Subscribe to my email list and stay
up-to-date!

recent articles

ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer

Malware / September 25, 2026

AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway

Malware / September 25, 2026

U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog

Hacking / September 25, 2026

Ryuk Member Karen Vardanyan Sentenced to Two Years in U.S. Prison

Cyber Crime / September 24, 2026

AI Helps Uncover MikroTrick Attack Chain in MikroTik RouterOS

Hacking / September 24, 2026