Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer

An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic.

"When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the Windows Run dialog," Arctic Wolf Labs said in a technical report shared with The Hacker News.

The ClickFix chain uses an "msiexec.exe" command to fetch a Windows MSI installer that's used to deliver the stealer malware. The malicious tool is designed to harvest browser passwords, account tokens, and cryptocurrency-wallet data, set up scheduled-task persistence, and contact a command-and-control (C2) server for additional tasking.

Some of the compromised websites include a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller and publisher, a psychological facility, a tool retailer, and an automotive retailer. These affected sites include an injected iframe element that's responsible for executing attacker-controlled JavaScript ("fsputnik[.]com/tds/tracker[.]js").

The ClickFix command, for its part, retrieves an MSI installer ("elita.msi") hosted on "uasputnik[.]com," a domain that was registered on September 9, 2026. Other MSI payloads identified include "miks.msi," "astra.msi," "harbor.msi," "neon.msi," "sova.msi," and "vyse.msi."

"The attacker-controlled page imitates a Cloudflare verification screen and presents Ukrainian-language instructions," Arctic Wolf said. "The clipboard operation occurs before the lure displays its Windows Run instructions. After a three-second spinner, the page presents an instruction dialog and keeps the 'Done' button disabled for approximately 35 additional seconds."

"This delay controls progression through the lure interface; it does not verify that the visitor opened Windows Run, pasted the command, or installed the payload."

The MSI installer, for its part, is responsible for retrieving the next-stage payload ("psychedeliclove.exe") from the URL "107.175.82[.]242:9000." The 64-bit Windows executable is Psychedelic Stealer, which performs the following functions -

• Collect credentials from Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex, and exfiltrate them through the "/api/v1/ext/passwords" endpoint
• Collect browser-associated account tokens and exfiltrate them through the "/api/v1/ext/tokens" endpoint
• Scan for known cryptocurrency wallet browser extensions (MetaMask, Trust Wallet, OKX Wallet, and SafePal) and desktop apps (Exodus, Atomic Wallet, Electrum, Bitcoin Core, and Litecoin Core) and exfiltrate data through the "/api/v1/ext/wallets" endpoint
• Capture extensive host information and exfiltrate it through the "/api/v1/checkin" endpoint
• Terminate selected browser processes, extract an embedded extension archive into web browser profiles, and set a native-messaging bridge

"These components extend the operation beyond one-time data collection," Arctic Wolf said. "Browser-profile modification and native messaging provide a mechanism for deployed browser content to communicate with a local host component."

"A recurring background routine revisits extension-related operations before polling the C2 server for tasks, indicating that browser-component handling is integrated into the implant's ongoing execution cycle rather than limited to initial installation."

Psychedelic Stealer also features the ability to retrieve further tasks using the "/api/v1/agent/tasks?hwid=%s" endpoint, where "hwid" refers to a unique victim identifier. It can allow the malware to run EXE, COM, BAT, CMD, MSI, and PowerShell payloads, offering the operator a way to introduce additional malware.

Arctic Wolf said it identified an exposed lure management panel linked to the campaign called РУБЛЁВКА TDS (Rublevka TDS) on the "uasputnik[.]com" domain. The panel, which is distinct from the implant's C2 ("193.178.159[.]128:8080"), is used to configure web-lure commands and records interactions.

"The dashboard polls visitor records every two seconds, providing near-real-time visibility into progression through the lure interface, not endpoint execution," it added.

At the time of analysis, the panel recorded 557 views, 426 clicks, and 79 complete events across 32 countries, with Ukraine accounting for 446 views, 351 clicks, and 71 complete events. Other targets include the U.S., Poland, Germany, Canada, and the Netherlands.

"Russian-language branding and implementation artifacts suggest likely Russian operators, and the intended audience is clear: Ukrainian-language instructions, affected Ukrainian business websites, and the panel's concentration of recorded views in Ukraine support an assessment that the campaign focused heavily on Ukrainian users," the cybersecurity company concluded.

ClickFix Delivers RemotePanel and BoundSiphon

The development comes as Blackpoint Cyber said it identified two undocumented .NET malware components delivered together via a ClickFix chain: RemotePanel, a persistent remote access platform, and BoundSiphon, a .NET credential and cryptocurrency stealer that targets both Chromium and Firefox browsers.

"RemotePanel establishes persistence by masquerading as the Windows Time service and gives operators broad control over infected systems, including PowerShell, file and process management, screen access, modular HVNC, and fleet management," researchers Nevan Beal, Sam Decker, and Andi Ursry said.

"BoundSiphon runs primarily from memory and targets browser credentials and sessions, cryptocurrency wallets, password manager data, and selected documents, including secrets protected by Chromium App-Bound Encryption."

RemotePanel makes use of a BNB Smart Chain contract to resolve its C2 server, thereby allowing the threat actors to rotate infrastructure without rebuilding or redeploying the malware on infected hosts. BoundSiphon, on the other hand, is assessed to share overlaps with a stealer that was flagged as being distributed via five malicious NuGet packages back in May 2026.

The attack sequence begins with a ClickFix command that uses PowerShell to initiate a multi-stage chain, with one of the intermediate components abusing the CMSTPLUA COM object to bypass User Account Control (UAC) and gain elevated administrative privileges without prompting the user and run a privileged hidden PowerShell process.

The process then proceeds to configure broad Microsoft Defender exclusions and fetch and execute two additional payloads using different methods -

• RemotePanel, which is written to disk, installed as a service, and is used for persistent remote access and operator control through interactive PowerShell sessions, file and process management, screen streaming, and modular hidden virtual network computing (hVNC)
• BoundSiphon, which is loaded directly into memory through PowerShell, and is used for credential, session, wallet, and document collection

The campaign has not been attributed to any known threat actor or group, although Blackpoint said it recovered artifacts that suggest a possible Russian-speaking development environment. This includes source code checks to avoid executing on systems with a Russian keyboard layout.

"RemotePanel and BoundSiphon reflect a broader shift toward modular malware ecosystems that separate persistent access from data theft, allowing operators to replace infrastructure and individual components while retaining the underlying capabilities needed to continue an operation," Blackpoint said.

"RemotePanel can move its backend through an owner-controlled BNB Smart Chain resolver without rebuilding the implant, while BoundSiphon moves its App Bound Encryption recovery into legitimate Chromium processes to reach newer browser secrets."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.