ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer

Attackers hijacked Ukrainian websites to deliver a fake Cloudflare CAPTCHA that installs Psychedelic Stealer and steals browser and crypto credentials.

Psychedelic Stealer is being distributed through compromised Ukrainian business websites. Attackers injected hidden iframes into legitimate pages and used them to display a fake Cloudflare verification screen to visitors. The affected sites included a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller, a psychological facility, a tool retailer, and an automotive retailer.

These were legitimate businesses with established social media profiles and third-party listings. Visitors were therefore directed to a trusted website they may have visited before, making the fake Cloudflare CAPTCHA harder to recognize.

That’s the core of what makes this campaign uncomfortable to dismiss. Visitors didn’t stumble onto an obvious fake domain. They landed on a site they may have visited before, for a business they already had some reason to trust, and got served a fake CAPTCHA instead of the page they were looking for.

The fake verification page imitates Cloudflare, complete with a randomly generated “Ray ID” in the footer and a fixed “visitor identifier” in the agreement text. Both look like the kind of tracking and authentication markers Cloudflare actually uses, and neither one means anything here.

“The page footer displays a randomly generated hexadecimal “Ray ID.” Cloudflare assigns a legitimate Ray ID to each request that passes through its network, but the value displayed by this lure is not evidence that Cloudflare performed the verification.” reads the report published by ArticWolf. “The agreement text also contains a fixed “visitor identifier.” Both identifiers imitate familiar verification and tracking elements, making the page appear more legitimate without providing evidence of an authentic Cloudflare verification. Put simply, all of this is fake; window dressing to fool the site visitor.”

The page is written in Ukrainian, which fits the target audience, but its HTML carries Russian-language comments and the document declares lang=”ru,” a detail that tells you something about who built it even if it doesn’t confirm nationality or location.

When the victim clicks the fake CAPTCHA, the page silently copies a Windows Installer command to the clipboard. It then tells the user to press Windows+R, paste the command and press Enter. There is no PowerShell involved, which can help the attack bypass security controls focused on detecting malicious PowerShell activity. Instead, the command directly launches msiexec.exe. It also includes the fake Cloudflare verification text, making the command in the Run window look like part of the verification process.

The downloaded MSI file then installs a 64-bit executable called psychedeliclove.exe, which Arctic Wolf Labs tracks as Psychedelic Stealer. The malware targets saved passwords from browsers such as Chrome, Edge, Brave, Opera, Opera GX, Vivaldi and Yandex. It also steals browser account tokens and targets cryptocurrency wallets, including Exodus, Atomic Wallet, Electrum, Bitcoin Core and Litecoin Core.

Beyond the one-time credential grab, the implant installs browser components and sets up a native messaging bridge that lets deployed browser content communicate with a local process on the machine. It creates a scheduled task for persistence named psychedelicloveUtils, profiles the host in detail including antivirus status and installed browsers, and then starts polling its command-and-control server for additional tasks. As Arctic Wolf Labs puts it:

“The implant tracks task state in executed_tasks.json, downloads attachments into downloads\<taskid>_<filename>, and supports EXE, COM, BAT, CMD, MSI, and PowerShell files.” states the report. “This gives operators a route to introduce additional code after installation.”

Which means whoever’s behind this isn’t necessarily done with a compromised machine after the initial credential sweep. The remote tasking capability supports EXE, COM, BAT, CMD, MSI, and PowerShell payloads, so the initial infection is better understood as a foothold than a finished operation.

The campaign also uses a management panel called “РУБЛЁВКА TDS” (Rublevka TDS), a name referring to the wealthy Rublevka area near Moscow. The panel allows the attackers to control the Windows Installer command delivered by each compromised website. This means they can change the payload URL from one place without modifying every infected page.

The panel also tracks how visitors interact with the fake CAPTCHA. It records when the page is opened, when the CAPTCHA is clicked and when the user presses the Done button.

The Done button remains disabled for about 35 seconds after the command is copied. The delay has no technical purpose. It simply gives victims enough time to follow the instructions and run the command, adding another layer of social engineering to the attack.

At collection time the panel showed 557 views, 426 clicks, and 79 complete events across 32 countries. Ukraine accounted for 446 of those views and 351 of the clicks, which combined with Ukrainian-language instructions and Ukrainian business websites makes the targeting intent about as clear as it gets. The panel labeled its complete events as “executions” and calculated a conversion rate from them, which Arctic Wolf correctly points out overstates actual confirmed compromises, since a complete event only means someone clicked Done in the browser, not that they ran anything.

The domain at the center of this, uasputnik[.]com, was registered September 9, 2026, updated three and a half hours later, and associated with lure URLs appearing on September 12 and 13. The whole operational window from registration to observed delivery fits inside a week.

For defenders, there are several useful indicators to monitor. Network traffic to uasputnik[.]com, followed by a request to admin777111777.php, could indicate an early stage of the attack. A later-stage sign is traffic to 193.178.159[.]128:8080, particularly requests to /api/v1/agent/ and /api/v1/ext/ with an X-API-Key header.

These indicators should be investigated together with file creation and process execution events to confirm whether a system has been compromised.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

---

---