An active cyberattack campaign has compromised multiple legitimate Ukrainian business websites to inject fake Cloudflare verification pages that deliver a previously undocumented information-stealing malware called Psychedelic, according to a technical report published by Arctic Wolf Labs on September 25, 2026. The attackers have breached sites including a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller and publisher, a psychological facility, a tool retailer, and an automotive retailer. When visitors interact with the bogus verification page, it copies a Windows Installer command to their clipboard and directs them to paste it into the Windows Run dialog, triggering the download of malware designed to harvest browser passwords, account tokens, and cryptocurrency-wallet data.
The compromised websites contain an injected iframe element that executes attacker-controlled JavaScript hosted on "fsputnik[.]com/tds/tracker[.]js," which loads the fake Cloudflare verification screen with Ukrainian-language instructions. The ClickFix command retrieves an MSI installer from "uasputnik[.]com," a domain registered on September 9, 2026, with identified payloads including "elita.msi," "miks.msi," "astra.msi," "harbor.msi," "neon.msi," "sova.msi," and "vyse.msi." The installer then fetches the next-stage payload, a 64-bit Windows executable called Psychedelic Stealer, from the URL "107.175.82[.]242:9000." The stealer collects credentials from Chromium-based browsers including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex, captures browser-associated account tokens, scans for cryptocurrency wallet browser extensions like MetaMask, Trust Wallet, OKX Wallet, and SafePal as well as desktop apps including Exodus, Atomic Wallet, Electrum, Bitcoin Core, and Litecoin Core. At the time of analysis, an exposed lure management panel called РУБЛЁВКА TDS (Rublevka TDS) recorded 557 views, 426 clicks, and 79 complete events across 32 countries, with Ukraine accounting for 446 views, 351 clicks, and 71 complete events.
According to Arctic Wolf, "the attacker-controlled page imitates a Cloudflare verification screen and presents Ukrainian-language instructions," with the clipboard operation occurring before the lure displays its Windows Run instructions. After a three-second spinner, the page presents an instruction dialog and keeps the "Done" button disabled for approximately 35 additional seconds, though "this delay controls progression through the lure interface; it does not verify that the visitor opened Windows Run, pasted the command, or installed the payload." The report notes that "browser-profile modification and native messaging provide a mechanism for deployed browser content to communicate with a local host component," indicating the malware goes beyond one-time data collection. The cybersecurity company concluded that "Russian-language branding and implementation artifacts suggest likely Russian operators, and the intended audience is clear: Ukrainian-language instructions, affected Ukrainian business websites, and the panel's concentration of recorded views in Ukraine support an assessment that the campaign focused heavily on Ukrainian users."
Psychedelic Stealer's capabilities extend to modifying browser profiles and establishing persistence through scheduled tasks, with the malware terminating selected browser processes, extracting an embedded extension archive into web browser profiles, and setting up a native-messaging bridge. The stealer can retrieve additional tasks using a "/api/v1/agent/tasks?hwid=%s" endpoint, where "hwid" refers to a unique victim identifier, allowing operators to run EXE, COM, BAT, CMD, MSI, and PowerShell payloads to introduce further malware. Other targets identified in the campaign include the U.S., Poland, Germany, Canada, and the Netherlands. The report comes as Blackpoint Cyber separately identified two undocumented .NET malware components delivered together via a ClickFix chain: RemotePanel, a persistent remote access platform that masquerades as the Windows Time service, and BoundSiphon, a credential and cryptocurrency stealer that targets both Chromium and Firefox browsers and shares overlaps with a stealer distributed via five malicious NuGet packages in May 2026. The social-engineering approach behind ClickFix campaigns demonstrates how attackers can weaponize user trust in familiar security interfaces to bypass technical defenses entirely. Organizations relying on user awareness as a primary control may need to reconsider whether education alone can counter increasingly sophisticated interface mimicry that exploits routine security interactions.