Psychedelic Stealer Campaign Uses Fake Cloudflare CAPTCHA Against Ukrainian Website Visitors

Arctic Wolf Labs is tracking an ongoing malware campaign that compromises legitimate Ukrainian business websites and uses injected iframes to present visitors with a fake Cloudflare verification page.

The campaign combines three elements: compromised websites, a ClickFix-style social engineering lure, and an information-stealing Windows implant that Arctic Wolf calls Psychedelic Stealer.

The operation is notable because the initial lure does not necessarily require victims to visit an obviously malicious website. Instead, attackers inject content into legitimate Ukrainian business websites, exposing existing visitors to an attacker-controlled fake CAPTCHA.

A compromised website becomes the entry point

Arctic Wolf identified affected Ukrainian websites associated with several real businesses, including a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller and publisher, a psychological facility, a tool retailer and an automotive retailer.

The security researchers found injected iframe code on the compromised websites. The iframe loads attacker-controlled infrastructure and presents the fake verification experience to visitors.

The researchers also identified the script reference:

fsputnik[.]com/tds/tracker[.]js

The investigation found evidence supporting the conclusion that the websites were legitimate operating businesses that had been compromised, rather than websites created by attackers to impersonate those organisations.

This delivery method gives the campaign an important social-engineering advantage. A visitor may already recognise and trust the website they are viewing before encountering the malicious verification prompt.

The ClickFix lure imitates Cloudflare verification

The attacker-controlled page imitates a Cloudflare verification screen and uses Ukrainian-language instructions.

The page displays elements designed to resemble familiar verification mechanisms, including a randomly generated hexadecimal value presented as a "Ray ID" and a fixed visitor identifier.

Arctic Wolf stresses that these values do not demonstrate that Cloudflare performed any verification. They are visual elements used by the lure to make the page appear legitimate.

The page uses Ukrainian-language text while containing Russian-language implementation comments and other artifacts. Arctic Wolf says these details provide context about the campaign but are not sufficient to independently establish the operators' nationality, location or affiliation.

Instead of PowerShell, the campaign uses Windows Installer

The ClickFix sequence uses a Windows Installer command rather than relying on a conventional encoded PowerShell command.

When a visitor interacts with the fake CAPTCHA, the page calls functions that report the interaction and copy a remotely retrieved command to the clipboard.

The browser itself does not execute the command.

The victim is then instructed to:

1. Press Windows + R

2. Paste the clipboard contents

3. Press Enter

4. Return to the browser and continue the verification flow

The command observed by Arctic Wolf invokes Msiexec.exe and retrieves an MSI package from attacker-controlled infrastructure.

The command also contains Ukrainian verification-themed text in the ORG_NOTE property, creating visual continuity between the fake browser verification and the Windows execution step.

Important limitation: a recorded click does not prove that the clipboard operation succeeded, and a "complete" event does not prove that the command was executed or that malware was installed.

Centralised lure management

The campaign's web lure retrieves its command remotely.

On page load, the lure requests a plain-text command from an attacker-controlled PHP endpoint. A response longer than five characters replaces the initial in-memory value.

The architecture separates the legitimate website shown to the visitor from the infrastructure that supplies the command and MSI payload. This allows the same lure to be reused across multiple compromised websites.

Arctic Wolf also identified an exposed management panel branded РУБЛЁВКА TDS. The researchers describe it as a lure-management panel rather than the malware's command-and-control system.

The panel allowed operators to configure commands for specific domains and collect interaction events from visitors.

557 views were recorded across 32 countries

At the time of collection, the exposed panel recorded:

Ukraine represented the largest share of recorded activity in the panel.

However, Arctic Wolf makes an important distinction between lure interaction and successful infection.

A "view" represents page initialisation. A "click" represents interaction with the CAPTCHA container. A "complete" event is triggered when the visitor selects the enabled Done button.

None of these events independently proves malware execution, MSI installation, endpoint check-in or successful compromise.

Psychedelic Stealer targets credentials, tokens and cryptocurrency wallets

The final malware identified by Arctic Wolf is a 64-bit Windows executable named psychedeliclove.exe.

Arctic Wolf uses the name Psychedelic Stealer because the binary contains the embedded configuration tag "Psychedelic". The researchers have not attributed the malware to a previously known malware family or a known threat group.

The malware contains several information-stealing capabilities.

Browser password theft

Psychedelic Stealer targets Chromium-based browsers including:

• Chrome

• Edge

• Brave

• Opera

• Opera GX

• Vivaldi

• Yandex

Its password collection logic extracts information such as website URLs, usernames and decrypted passwords, together with browser and profile context.

The collected password records are submitted through:

/api/v1/ext/passwords

Browser token collection

The malware also targets browser-associated account tokens.

It accesses Chromium's Web Data database, creates a temporary copy named wd_tmp.db, and processes records containing fields such as service, Gaia ID and token information.

The resulting data is submitted through:

/api/v1/ext/tokens

Arctic Wolf specifically notes that the presence of token-collection functionality does not by itself demonstrate successful session hijacking or account takeover. The researchers did not observe successful account takeover during their investigation.

Cryptocurrency wallet theft

The malware also searches for cryptocurrency wallet information from two sources.

Browser extensions include targets associated with:

• MetaMask

• Trust Wallet

• OKX Wallet

• SafePal

Desktop wallet targets include:

• Exodus

• Atomic Wallet

• Electrum

• Bitcoin Core

• Litecoin Core

The collected wallet information is submitted through:

/api/v1/ext/wallets

This combination means the malware is designed to search beyond conventional browser credentials and collect information associated with cryptocurrency assets.

Browser components extend the malware's capabilities

Psychedelic Stealer contains functionality for terminating selected browser processes, extracting an embedded browser extension archive into browser profiles and replacing a victim-specific placeholder.

The malware also creates components including:

• host.ps1

• host.bat

• com.lunex.explorer.json

These components support a native-messaging bridge named com.lunex.explorer.

The browser-related functionality indicates that the malware is not limited to a one-time credential collection process. It contains mechanisms for modifying browser environments and communicating with a local host component.

Persistence and remote tasking

The malware establishes persistence through a Windows scheduled task named:

psychedelicloveUtils

It also collects extensive host information, including computer name, username, operating-system information, processor and memory details, graphics information, disk capacity, timezone, language, screen information, MAC address, administrator status, antivirus information and installed-browser details.

The implant communicates with a command-and-control server and supports multiple API functions.

The malware can also download task attachments and supports several executable formats, including EXE, COM, BAT, CMD, MSI and PowerShell files.

This remote-tasking capability gives operators a mechanism to introduce additional code after the initial installation.

What the infrastructure timeline shows

Arctic Wolf observed the malicious domain uasputnik.com being registered on September 9, 2026.

The researchers associated the domain with 176.53.159.40 between September 9 and September 14. Lure URLs referencing compromised Ukrainian websites were subsequently observed on September 12 and September 13.

The investigation also identified an MSI-associated component that contained an encrypted reference to a later-stage executable hosted at:

107.175.82.242:9000/wilow/psychedeliclove.exe

The MSI packages observed during the investigation included elita.msi, miks.msi and sova.msi.

Arctic Wolf notes that the delivery packages changed during the observation period, indicating continued modification of the campaign infrastructure.

Arctic Wolf's assessment

Arctic Wolf describes the operation as a combination of three layers:

1. Compromised legitimate websites provide the initial delivery surface.

2. A configurable ClickFix lure attempts to persuade visitors to execute a Windows Installer command.

3. Psychedelic Stealer collects credentials, tokens and wallet information while maintaining persistence and accepting remote tasks.

The combination is significant because the initial website compromise changes the context in which the social-engineering attack appears. Instead of beginning with an unfamiliar malicious domain, the victim encounters the lure while browsing a legitimate business website.

Arctic Wolf also says Russian-language branding and implementation artifacts suggest likely Russian operators, but the researchers did not attribute the activity to a specific threat actor. They also state that these artifacts alone cannot verify the operators' nationality, location or affiliation.

The researchers describe the malware's credential, token and wallet collection as consistent with financially motivated activity, while noting that the remote-tasking capability could support additional objectives.

These are Arctic Wolf's analytical assessments rather than independently established attribution.

Detection and hunting opportunities

Arctic Wolf provides several defensive hunting opportunities based on the infrastructure and behaviour observed during the investigation.

Security teams can investigate access to:

uasputnik.com/sputnik.html

particularly when accompanied by requests associated with payload retrieval or beacon activity.

The researchers recommend treating direct access to the executable URL as stronger evidence of attempted payload retrieval than a simple lure-page view, while correlating network activity with file creation and execution before determining that an infection occurred.

Network telemetry involving the identified C2 endpoint and API paths can also provide additional context.

Arctic Wolf emphasises that these are evidence-derived hunting leads, not deployed or tested detection rules. Correlation is preferable to alerts based solely on generic filenames, strings or individual indicators.

What defenders should take from the campaign

The campaign demonstrates several defensive considerations.

First, legitimate websites can become part of a malware delivery chain when attackers compromise their web infrastructure. Website reputation alone therefore cannot guarantee that every resource loaded by a trusted domain is safe.

Second, ClickFix-style attacks rely heavily on user interaction. The browser presents the instruction, but the victim ultimately performs the Windows execution step.

Third, security monitoring that focuses primarily on encoded PowerShell may miss attacks that use Windows Installer through Msiexec.exe.

Finally, defenders should distinguish between evidence of a lure being displayed and evidence of actual endpoint compromise. Arctic Wolf's analysis of the exposed panel provides a clear example: hundreds of recorded interactions show that visitors progressed through the web lure, but those events do not independently establish successful malware execution.

Conclusion

The Psychedelic Stealer campaign combines website compromise, ClickFix social engineering, MSI delivery and an information-stealing Windows implant.

The use of legitimate Ukrainian business websites gives the initial lure a trusted context, while the remote command mechanism allows the operators to manage delivery across multiple compromised domains. Once installed, the malware targets browser credentials, account tokens and cryptocurrency-wallet information and establishes persistence for continued remote tasking.

For defenders, the campaign reinforces the importance of monitoring not only traditional malware execution techniques but also browser-based social engineering, Windows Installer activity, suspicious website modifications and the network behaviour that follows.