ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer
Attackers hijacked Ukrainian sites with a fake Cloudflare CAPTCHA to install Psychedelic Stealer and steal credentials.
Arctic Wolf Labs says attackers injected hidden iframes into legitimate Ukrainian business sites to show a Ukrainian-language fake Cloudflare CAPTCHA. Clicking it copies an msiexec command that victims are instructed to run with Windows+R, installing psychedeliclove.exe, tracked as Psychedelic Stealer. The malware steals passwords and tokens from Chrome, Edge, Brave, Opera, Vivaldi and Yandex, plus wallets including Exodus, Atomic, Electrum, Bitcoin Core and Litecoin Core, then persists with scheduled task psychedelicloveUtils and can fetch further payloads. A Rublevka TDS panel recorded 557 views and 426 clicks, mostly from Ukraine; lure domain uasputnik.com was registered on September 9, 2026.
- Hidden iframes on Ukrainian business sites showed a fake Cloudflare CAPTCHA.
- Victims are told to run a pasted msiexec command, not PowerShell.
- The stealer takes browser passwords, tokens and several crypto wallets.
- Task psychedelicloveUtils and remote tasking support later payloads.
- Panel data showed 446 of 557 views and 351 clicks from Ukraine.
- ATT&CK
- T1189 Drive-by CompromiseT1204.004 Malicious CommandT1218.007 MsiexecT1555.003 Credentials from Web BrowsersT1053.005 Scheduled Task
- Vendors
- CloudflareMicrosoftGoogle
- Malware
- Psychedelic Stealer
- Victims
- Ukrainian businesses
- Organizations
- Arctic Wolf
- Countries
- Ukraine
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | uasputnik.com | t that they ran anything. The domain at the center of this, uasputnik[.]com, was registered September 9, 2026, updated three and a ha |
| ipv4 | 193.178.159.128 | early stage of the attack. A later-stage sign is traffic to 193.178.159[.]128:8080 , particularly requests to /api/v1/agent/ and /api/v |
From the original article
4 min read at securityaffairs.com
Attackers hijacked Ukrainian websites to deliver a fake Cloudflare CAPTCHA that installs Psychedelic Stealer and steals browser and crypto credentials. Psychedelic Stealer is being distributed through compromised Ukrainian business websites. Attackers injected hidden iframes into legitimate pages and used them to display a fake Cloudflare verification screen to visitors.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.