Arctic Wolf Details ClickFix Campaign Delivering Psychedelic Stealer Through Compromised Ukrainian Websites

Sep 24, 2026 · Original article ↗

Summary

Arctic Wolf describes a ClickFix campaign using injected iframes on legitimate Ukrainian websites to deliver Psychedelic Stealer. The malware targets browser credentials, tokens and wallet data; lure-panel interactions do not confirm execution or compromise.

Key points

Injected iframes on legitimate Ukrainian business websites displayed a Ukrainian-language fake Cloudflare verification lure.
The ClickFix lure copied a Windows Installer command for the visitor to paste into Windows Run; interaction with the page alone does not establish command execution.
Arctic Wolf analyzed Psychedelic Stealer, which targets browser passwords, account tokens, and browser-extension and desktop cryptocurrency-wallet data.
The implant can modify browser profiles, establish scheduled-task persistence, profile hosts, and poll its C2 for tasks and additional payloads.
An exposed lure-management panel recorded 557 views across 32 countries, including 446 assigned to Ukraine; its events do not confirm malware execution or compromise.
Arctic Wolf did not attribute the operation to a known threat group and says language and branding artifacts are insufficient to verify operator nationality.

Article Details

Attack Vectors: Attackers injected an iframe into legitimate Ukrainian business websites to load an attacker-controlled, Ukrainian-language fake CAPTCHA.
The lure copied a remotely configured msiexec command to the clipboard and instructed visitors to paste and run it through Windows+R. The browser did not execute the copied command.
The command downloaded an MSI package, which led to delivery of Psychedelic Stealer. The analyzed MSI-associated component also retrieved an executable from a separate URL.
Psychedelic Stealer collects browser passwords, browser-associated account tokens, and cryptocurrency-wallet data; modifies browser profiles with components and a native-messaging bridge; creates a logon scheduled task; and polls its C2 for tasks and attachments.
The lure panel recorded views, clicks, and completion events, but those events do not establish command execution, malware installation, or successful compromise. Arctic Wolf Labs did not attribute the activity to a named threat actor; Russian-language artifacts only suggested likely Russian operators, whose nationality, location, or affiliation could not be verified.
Defensive Notes: Hunt for access to uasputnik[.]com/sputnik.html and related site= variants, followed by get_payload requests or beacon POSTs; subsequent access to /elita.msi is a later delivery-stage signal.
Treat access to the exact executable URL as stronger evidence of attempted payload retrieval than a lure-page view, and correlate network activity with file creation and execution before assessing an infection.
Where telemetry permits, inspect traffic to the implant C2 and its /api/v1/agent/ and /api/v1/ext/ paths, including the X-API-Key header. Exact paths and endpoint activity are more distinctive than generic user-agent strings.
Look for the logon scheduled task named psychedelicloveUtils and related browser-profile, native-messaging, and task-attachment artifacts. The article presents these as evidence-derived hunting leads, not deployed or tested detection rules.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`uasputnik[.]com`	Attacker-controlled domain used for the fake CAPTCHA lure, command configuration, and MSI delivery.
IPV4	`107[.]175[.]82[.]242`	Host serving the Psychedelic Stealer executable identified in MSI-associated analysis.
IPV4	`176[.]53[.]159[.]40`	A-record address associated with the attacker-controlled uasputnik[.]com domain during the reported delivery period.
IPV4	`193[.]178[.]159[.]128`	Psychedelic Stealer command-and-control server address.
SHA256	`06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90`	SHA-256 hash of the Psychedelic Stealer executable.
SHA256	`38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878`	SHA-256 hash identified for the elita.msi first-stage package.
URL	`hxxp[:]//107[.]175[.]82[.]242:9000/wilow/psychedeliclove.exe`	Executable download URL recovered from MSI-associated analysis.
URL	`hxxp[:]//193[.]178[.]159[.]128:8080`	Hardcoded Psychedelic Stealer command-and-control base URL.
URL	`hxxps[:]//fsputnik[.]com/tds/tracker[.]js`	Script URL identified in the injected iframe as part of the attacker-controlled campaign infrastructure.
URL	`hxxps[:]//uasputnik[.]com/elita.msi`	MSI installation package URL embedded in the ClickFix command.
URL	`hxxps[:]//uasputnik[.]com/sputnik.html`	Lure page hosted on the attacker-controlled campaign domain.