Psychedelic Stealer Campaign Targeting Ukraine via ClickFix

Arctic Wolf Labs and Blackpoint Cyber are tracking an ongoing campaign targeting Ukrainian users by compromising legitimate business websites to inject malicious iframes. These iframes display a fake Cloudflare CAPTCHA (ClickFix) that tricks users into copying a malicious command to their clipboard and executing it via the Windows Run dialog. The campaign primarily delivers a previously undocumented infostealer dubbed Psychedelic Stealer, alongside other persistent threats like RemotePanel and BoundSiphon.

The attack chain is notable for its use of legitimate local business traffic and a shift from encoded PowerShell to Windows Installer (msiexec.exe) commands to bypass traditional detection. The infrastructure includes a Russian-branded lure-management panel called 'РУБЛЁВКА TDS', which tracks visitor interaction across 32 countries, though the primary focus remains on Ukraine.

The business impact is severe, as the malware targets browser credentials, session tokens, and a wide array of cryptocurrency wallets (e.g., MetaMask, Trust Wallet). Furthermore, the inclusion of remote tasking and persistent backdoors like RemotePanel allows operators to maintain long-term access and deploy additional payloads, transforming a one-time data theft into a sustained breach.