As reported by The Hacker News, Arctic Wolf Labs has published findings on an active ClickFix campaign that has compromised multiple legitimate Ukrainian business websites to deliver a previously undocumented information stealer dubbed Psychedelic. The campaign is notable not for its technical sophistication but for its effective abuse of trusted security-industry branding and the increasingly popular clipboard-paste social engineering vector.

Threat Alert: As reported by The Hacker News, Arctic Wolf Labs has published findings on an active ClickFix campaign that has compromised multiple legitimate Ukrainian business websites to deliver a previously undocumented information stealer dubbed Psychedelic.

Why This Campaign Deserves Attention

The ClickFix pattern — where attackers display a fake verification or CAPTCHA page, copy a malicious command to the user's clipboard, and instruct them to paste it into the Windows Run dialog — has been steadily gaining traction throughout 2025 and into 2026. What makes this particular deployment significant is the combination of compromised legitimate infrastructure and the impersonation of Cloudflare's anti-bot verification flow.

Security professionals have long understood that users are conditioned to trust familiar security UX patterns. When a user encounters what appears to be a Cloudflare challenge on a legitimate-looking business website, their instinct is to comply — especially when the instructions appear in their native language. Arctic Wolf notes that the lure page even includes a deliberate 35-second delay before enabling the "Done" button, creating an artificial sense of processing that reinforces the illusion of legitimacy.

Attack Chain Analysis

The kill chain proceeds through several distinct stages, each of which presents a potential detection or interdiction opportunity for defenders:

  • Initial compromise: Attacker injects an iframe element into legitimate Ukrainian business websites, loading JavaScript from fsputnik[.]com/tds/tracker[.]js
  • Lure display: Fake Cloudflare verification page renders with Ukrainian-language instructions
  • Clipboard manipulation: An msiexec.exe command is silently copied to the clipboard before the instructions are shown
  • User execution: Victim pastes the command into Windows Run (Win+R), fetching an MSI installer from uasputnik[.]com
  • Payload delivery: The MSI retrieves psychedeliclove.exe from 107.175.82[.]242:9000
  • Data exfiltration: Psychedelic Stealer harvests credentials, tokens, and crypto wallet data via API endpoints

Notably, the attacker infrastructure — including the uasputnik[.]com domain registered on September 9, 2026 — was set up mere weeks before active deployment, suggesting a rapid operational tempo and potentially ongoing campaign rotation.

What Psychedelic Stealer Targets

The malware's data collection scope is broad but focused on high-value assets. It extracts credentials from all major Chromium-based browsers — Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex — plus browser account tokens that can enable session hijacking and persistence even after password resets. The stealer also scans for both browser-extension crypto wallets (MetaMask, Trust Wallet, OKX Wallet, SafePal) and desktop wallet applications (Exodus, Atomic Wallet, Electrum, Bitcoin Core, Litecoin Core). This dual-browser-and-desktop approach indicates the operator understands that serious cryptocurrency users often maintain hot wallets in both form factors.

Scheduled-task persistence ensures the malware survives reboots, and C2 communication allows for additional tasking — meaning this is not a simple smash-and-grab but a potentially long-duration foothold.

Broader Implications

This campaign reinforces several trends that security teams should be tracking:

  • ClickFix is not a fad. It has proven effective enough that multiple threat groups are adopting it. Expect further iterations targeting different brands and languages.
  • Legitimate site compromise remains a soft spot. The affected Ukrainian sites — ranging from a hair clinic to an automotive retailer — likely have minimal security staffing. Supply-chain and web-hosting providers should consider offering managed WAF and integrity-monitoring services to SMB customers.
  • Crypto wallet users remain a priority target. The inclusion of both extension and desktop wallet enumeration suggests the operators are specifically pursuing high-value crypto holdings.

Shield53 Recommendations

  • Deploy endpoint detection for msiexec.exe abuse: Monitor for msiexec.exe spawning from explorer.exe or rundll32.exe with remote URLs in command-line arguments. This is a high-fidelity indicator of ClickFix-style delivery.
  • Block known IoCs at the perimeter: Add fsputnik[.]com, uasputnik[.]com, and 107.175.82[.]242 to blocklists on firewalls, DNS resolvers, and EDR tooling. Monitor for any outbound connections to port 9000 on that IP.
  • Restrict PowerShell and Run dialog usage: For non-technical user populations, consider application allowlisting or Group Policy restrictions that prevent arbitrary msiexec execution from Run dialog.
  • Implement browser extension inventory and monitoring: Identify which users have crypto wallet extensions installed and apply enhanced monitoring. Consider isolating crypto operations to dedicated, hardened browser profiles.
  • Train users on the ClickFix pattern: User awareness training should explicitly cover the "paste this into Run" social engineering vector. No legitimate Cloudflare verification will ever ask you to paste a command into Windows Run.
  • Monitor for credential exfiltration patterns: Look for unexpected outbound HTTP POST requests to unfamiliar API endpoints, particularly those matching /api/v1/ext/ patterns, from endpoint systems.
  • Webmasters should implement integrity monitoring: Deploy file integrity monitoring on web servers and alert on unauthorized changes to HTML, JavaScript includes, or iframe additions. Regular scans for injected scripts should be part of site maintenance.

The Psychedelic Stealer campaign is a reminder that social engineering remains the most reliable entry vector in the threat landscape. When attackers can convince a user to execute arbitrary commands on their own machine, no perimeter defense will stop the initial foothold. The defense must be layered: user education, endpoint detection, and rapid response all play critical roles.