Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
Hacked Ukrainian websites serve fake Cloudflare ClickFix lures that install Psychedelic Stealer to steal credentials and crypto wallets.
Arctic Wolf Labs says an active ClickFix campaign compromised legitimate Ukrainian business sites and injected fake Cloudflare verification pages. The lure copies an msiexec command that fetches MSI installers from uasputnik[.]com, which then download psychedeliclove.exe, Psychedelic Stealer, from 107.175.82[.]242. The stealer collects Chromium passwords and tokens, cryptocurrency wallet data, and host details, persists via scheduled tasks, and can retrieve further payloads. A Rublevka TDS panel recorded 557 views and 79 completions, mostly in Ukraine; Arctic Wolf assesses likely Russian operators. The same reporting notes ClickFix delivery of RemotePanel and BoundSiphon.
- Compromised Ukrainian business sites inject fake Cloudflare checks via a tracker script.
- ClickFix copies an msiexec command that installs MSI payloads such as elita.msi.
- Psychedelic Stealer steals browser passwords, tokens, and cryptocurrency wallet data.
- It uses scheduled tasks and can run further EXE, script, MSI, and PowerShell payloads.
- Rublevka TDS logged 79 completions, 71 of them from Ukraine.
- ATT&CK
- T1189 Drive-by CompromiseT1204.002 Malicious FileT1218.007 MsiexecT1555.003 Credentials from Web BrowsersT1053.005 Scheduled Task
- Vendors
- Microsoft
- Products
- WindowsCloudflare
- Victims
- Ukrainian businesses
- Organizations
- Arctic WolfBlackpoint Cyber
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | fsputnik.com | responsible for executing attacker-controlled JavaScript ("fsputnik[.]com/tds/tracker[.]js"). The ClickFix command, for its part, r |
| domain | uasputnik.com | s part, retrieves an MSI installer ("elita.msi") hosted on "uasputnik[.]com," a domain that was registered on September 9, 2026. Othe |
| ipv4 | 107.175.82.242 | he next-stage payload ("psychedeliclove.exe") from the URL "107.175.82[.]242:9000." The 64-bit Windows executable is Psychedelic Steal |
| ipv4 | 193.178.159.128 | omain. The panel, which is distinct from the implant's C2 ("193.178.159[.]128:8080"), is used to configure web-lure commands and record |
From the original article
5 min read at thehackernews.com
An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. "When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.