Fake Cloudflare ClickFix Pages Push Psychedelic Stealer

A ClickFix malware campaign is using compromised Ukrainian business websites to display fake Cloudflare verification pages that trick visitors into running a command that installs a previously undocumented information stealer called Psychedelic, Arctic Wolf Labs reports.

When a visitor interacts with the lure, the page copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the Windows Run dialog, according to the Arctic Wolf technical report. The ClickFix chain uses an msiexec.exe command to fetch a Windows MSI installer that delivers the stealer. Psychedelic is designed to harvest browser passwords, account tokens, and cryptocurrency wallet data, set up scheduled-task persistence, and contact a command-and-control (C2) server for additional tasking.

The compromised websites include a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller and publisher, a psychological facility, a tool retailer, and an automotive retailer. Each affected site contains an injected iframe element that executes attacker-controlled JavaScript from fsputnik[.]com/tds/tracker[.]js. The ClickFix command retrieves an MSI installer called elita.msi that is hosted on uasputnik[.]com, a domain registered on September 9, 2026. Other MSI payloads identified in the campaign are miks.msi, astra.msi, harbor.msi, neon.msi, sova.msi, and vyse.msi.

The fake page imitates a Cloudflare verification screen and presents Ukrainian-language instructions. Arctic Wolf says the clipboard operation happens before the page shows the Windows Run instructions. After a three-second spinner, the page presents an instruction dialog and keeps the Done button disabled for about 35 additional seconds. That delay controls progression through the lure interface, but it does not verify that the visitor opened Windows Run, pasted the command, or installed the payload.

The MSI installer fetches the next-stage payload, psychedeliclove.exe, from the URL 107.175.82[.]242:9000. That 64-bit Windows executable is the Psychedelic Stealer. It collects credentials from Chromium-based browsers including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex, and exfiltrates them through the /api/v1/ext/passwords endpoint. It also collects browser-associated account tokens through /api/v1/ext/tokens, scans for known cryptocurrency wallet browser extensions such as MetaMask, Trust Wallet, OKX Wallet, and SafePal, as well as desktop apps including Exodus, Atomic Wallet, Electrum, Bitcoin Core, and Litecoin Core, and sends that data through /api/v1/ext/wallets. The malware captures extensive host information and exfiltrates it through /api/v1/checkin. It can also terminate selected browser processes, extract an embedded extension archive into web browser profiles, and set up a native-messaging bridge. Arctic Wolf notes that these components extend the operation beyond one-time data collection, and a recurring background routine revisits extension-related operations before polling the C2 server for tasks.

Psychedelic Stealer can retrieve further tasks using the /api/v1/agent/tasks?hwid=%s endpoint, where hwid is a unique victim identifier. It can run EXE, COM, BAT, CMD, MSI, and PowerShell payloads, giving the operator a way to introduce additional malware.

Arctic Wolf identified an exposed lure management panel linked to the campaign called РУБЛЁВКА TDS (Rublevka TDS) on the uasputnik[.]com domain. That panel is distinct from the implant C2 at 193.178.159[.]128:8080. The panel is used to configure web-lure commands and records interactions. Its dashboard polls visitor records every two seconds, providing near-real-time visibility into progression through the lure interface, not endpoint execution. At the time of analysis the panel recorded 557 views, 426 clicks, and 79 complete events across 32 countries. Ukraine accounted for 446 views, 351 clicks, and 71 complete events. Other targeted countries included the U.S., Poland, Germany, Canada, and the Netherlands. Arctic Wolf says Russian-language branding and implementation artifacts suggest likely Russian operators, and the concentration of recorded views in Ukraine, along with Ukrainian-language instructions and affected Ukrainian business websites, supports an assessment that the campaign focused heavily on Ukrainian users.

In a separate ClickFix delivery, Blackpoint Cyber reported two undocumented .NET malware components called RemotePanel and BoundSiphon delivered together. RemotePanel is a persistent remote access platform that establishes persistence by masquerading as the Windows Time service. It gives operators broad control over infected systems, including PowerShell, file and process management, screen access, modular hidden virtual network computing (HVNC), and fleet management. BoundSiphon is a .NET credential and cryptocurrency stealer that targets both Chromium and Firefox browsers. It runs primarily from memory and targets browser credentials and sessions, cryptocurrency wallets, password manager data, and selected documents, including secrets protected by Chromium App-Bound Encryption.

RemotePanel makes use of a BNB Smart Chain contract to resolve its C2 server, allowing the threat actors to rotate infrastructure without rebuilding or redeploying the malware on infected hosts. BoundSiphon is assessed to share overlaps with a stealer that was distributed via five malicious NuGet packages in May 2026. The attack sequence begins with a ClickFix command that uses PowerShell to start a multi-stage chain. An intermediate component abuses the CMSTPLUA COM object to bypass User Account Control and gain elevated administrative privileges without prompting the user, then runs a privileged hidden PowerShell process. That process configures broad Microsoft Defender exclusions and fetches and executes two additional payloads: RemotePanel written to disk and installed as a service, and BoundSiphon loaded directly into memory through PowerShell. The campaign has not been attributed to a known threat actor or group, although Blackpoint says recovered artifacts suggest a possible Russian-speaking development environment, including source code checks to avoid executing on systems with a Russian keyboard layout.

For website owners, the campaign is a reminder that a legitimate business site can be quietly turned into a malware delivery page through injected scripts. Reduced exposure comes from keeping the site and all its add-ons updated, removing unused components, and using a hosting provider that manages security. AEU Hosting offers managed WordPress hosting built to be secured end to end, which can reduce the chance of a site being turned into an attack page like the Ukrainian business sites described here.