Full Report
An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. "When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the
Analysis Summary
# Incident Report: Ukrainian Business Websites Compromised via ClickFix Campaign Delivering Psychedelic Stealer
## Executive Summary
An active "ClickFix" social engineering campaign has been observed compromising legitimate Ukrainian business websites to inject fraudulent Cloudflare verification pages. Visitors to these sites are tricked into executing a malicious Windows Installer command via the Windows Run dialog box, which infects their system with a previously undocumented information stealer named "Psychedelic." The attack results in the comprehensive theft of browser credentials, session tokens, and cryptocurrency wallet data, while establishing persistent access for potential secondary payloads.
## Incident Details
- **Discovery Date:** September 24, 2026 (Date of public reporting by Arctic Wolf Labs)
- **Incident Date:** Ongoing; initial infrastructure setup observed on or around September 9, 2026
- **Affected Organization:** Multiple legitimate Ukrainian businesses (including a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller/publisher, a psychological facility, a tool retailer, and an automotive retailer)
- **Sector:** Multiple (Healthcare, Manufacturing, Retail, Publishing)
- **Geography:** Ukraine
## Timeline of Events
### Initial Access
- **Date/Time:** Commenced early September 2026 (Malicious domain registered September 9, 2026)
- **Vector:** Web Server Compromise / Injection
- **Details:** Threat actors compromised legitimate Ukrainian business websites and injected a malicious iframe element. This iframe executed an attacker-controlled JavaScript file (`fsputnik[.]com/tds/tracker[.]js`), which intercepted user traffic and displayed a fake Cloudflare verification page in Ukrainian.
### Lateral Movement
- **Details:** This campaign focuses on external website visitors rather than lateral movement within the compromised organizations' hosting environments. However, on compromised user endpoints, the malware installs a native-messaging bridge allowing continuous, deep communication between browser components and the local host.
### Data Exfiltration/Impact
- **Details:** Once the victim executes the malicious payload, the Psychedelic stealer harvests browser credentials, account tokens, and cryptocurrency wallet data. This data is exfiltrated to the attacker's command-and-control (C2) server via specific API endpoints (`/api/v1/ext/passwords`, `/api/v1/ext/tokens`, and `/api/v1/ext/wallets`).
### Detection & Response
- **Details:** The incident was detected and analyzed by Arctic Wolf Labs. Investigators discovered an exposed traffic direction system (TDS) lure management panel called "РУБЛЁВКА TDS" (Rublevka TDS) on the domain `uasputnik[.]com`, which tracked real-time user interaction with the fake verification pages.
## Attack Methodology
- **Initial Access:** Malicious iframe injection into legitimate, vulnerable third-party business websites.
- **Persistence:** Configures Windows scheduled tasks and modifies web browser profiles to establish a recurring background native-messaging bridge.
- **Privilege Escalation:** Social engineering (ClickFix lure) forces the victim to manually execute an elevated `msiexec.exe` command via the Windows Run dialog box (`Win + R`).
- **Defense Evasion:** Uses an imitation Cloudflare interface to appear legitimate. The lure implements an artificial 35-second UI delay to disguise system processing and bypass automated dynamic analysis/sandboxes. It also terminates active browser processes to manipulate application profiles safely.
- **Credential Access:** Targets and extracts passwords and session tokens stored within Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, Yandex).
- **Discovery:** Performs host environment reconnaissance and system profiling, exfiltrating the data via a `/api/v1/checkin` endpoint.
- **Lateral Movement:** Not observed in this phase; focused primarily on individual endpoint compromise.
- **Collection:** Scans for and targets popular browser extension wallets (MetaMask, Trust Wallet, OKX Wallet, SafePal) and desktop cryptocurrency applications (Exodus, Atomic Wallet, Electrum, Bitcoin Core, Litecoin Core).
- **Exfiltration:** Standard HTTP POST requests sent directly to the hardcoded C2 infrastructure endpoints.
- **Impact:** Complete compromise of financial assets (crypto) and identity data, alongside the capability to fetch and execute secondary payloads (EXE, COM, BAT, CMD, MSI, PowerShell).
## Impact Assessment
- **Financial:** High risk of immediate financial loss due to targeted theft of cryptocurrency assets; remediation and incident response costs for affected web infrastructure.
- **Data Breach:** Compromise of sensitive user credentials, session cookies, and system metadata from any visitor who fell victim to the lure.
- **Operational:** Temporary disruption of compromised commercial web services; termination of local web browsers on infected endpoints.
- **Reputational:** Severe degradation of customer trust for the legitimate Ukrainian businesses whose websites hosted the malicious payloads.
## Indicators of Compromise
### Network Indicators
- `fsputnik[.]com/tds/tracker[.]js`
- `uasputnik[.]com` (Rublevka TDS Panel)
- `107.175.82[.]242:9000` (Payload Delivery Host)
- `193.178.159[.]128:8080` (Psychedelic Stealer C2)
### File Indicators
- `elita.msi`
- `miks.msi`
- `astra.msi`
- `harbor.msi`
- `neon.msi`
- `sova.msi`
- `vyse.msi`
- `psychedeliclove.exe` (64-bit Windows Executable)
### Behavioral Indicators
- Unauthorized modifications to the clipboard containing `msiexec.exe` strings.
- Spawning of `msiexec.exe` establishing external connections to non-standard remote ports (e.g., port 9000).
- Sudden termination of browser processes followed by unauthorized modification of browser profile directories and native-messaging host configurations.
## Response Actions
- **Containment:** Blocked communication to the known C2 IPs and domains (`193.178.159[.]128`, `107.175.82[.]242`, `uasputnik[.]com`, `fsputnik[.]com`) at the enterprise gateway level.
- **Eradication:** Injected iframes must be removed from the source code of the affected Ukrainian business websites. For infected endpoints, terminating the `psychedeliclove.exe` process, deleting associated scheduled tasks, and cleaning modified browser profiles is required.
- **Recovery:** Restoring affected websites from known-clean configurations and applying security patches to the underlying CMS/web servers. Forcing a global password and session token reset for affected endpoint users.
## Lessons Learned
- **Evolving Social Engineering:** Attackers are successfully pivoting away from traditional email phishing toward "ClickFix" web-lures that exploit trusted internet utilities like Cloudflare to trick users into running commands.
- **Endpoint vs. Web Integrity:** Organizations must protect not just their internal network endpoints, but monitor the integrity of their public-facing web servers, as they can easily be weaponized against the public.
## Recommendations
1. **Implement Web Integrity Monitoring:** Deploy File Integrity Monitoring (FIM) on web servers to detect unauthorized iframe or JavaScript injections immediately.
2. **Endpoint Execution Restrictions:** Restrict or closely monitor the behavior of `msiexec.exe` via EDR policies, particularly when it attempts to download payloads from external, unverified IP addresses.
3. **User Awareness Training:** Train employees to recognize "ClickFix" tactics. Emphasize that legitimate protection services (like Cloudflare) will never request a user to copy-paste scripts into the Windows Run dialog box.