ClickFix Campaign Uses Compromised Ukrainian Websites to Deliver Psychedelic Stealer

A new ClickFix campaign is compromising legitimate Ukrainian business websites to display fake Cloudflare verification pages and trick visitors into installing a previously undocumented information stealer called Psychedelic.

The campaign uses compromised websites to inject an attacker-controlled iframe that loads JavaScript from fsputnik[.]com/tds/tracker[.]js.

Affected websites include businesses such as a hair-treatment clinic, scale-model manufacturer, specialist bookseller, psychological facility, tool retailer, and automotive retailer.

How the ClickFix Attack Works

Visitors are shown a fake Cloudflare verification page with Ukrainian-language instructions.

The page copies a malicious Windows Installer command into the clipboard and instructs the victim to paste it into the Windows Run dialog.

The command uses msiexec.exe to download an MSI installer called elita.msi from:

uasputnik[.]com

The domain was registered on September 9, 2026.

Other MSI files linked to the campaign include:

• miks.msi
• astra.msi
• harbor.msi
• neon.msi
• sova.msi
• vyse.msi

The fake verification page displays a loading spinner before showing the Windows Run instructions. The interface also keeps its "Done" button disabled for approximately 35 seconds.

This delay only controls the lure's interface. It does not verify whether the victim actually opened Windows Run, executed the command, or installed the malware.

Psychedelic Stealer Payload

The MSI installer downloads the next-stage payload, psychedeliclove.exe, from an attacker-controlled server.

The 64-bit Windows executable is the Psychedelic Stealer, which can collect sensitive information from infected systems.

Its capabilities include:

• Stealing credentials from Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex
• Collecting browser-associated account tokens
• Targeting MetaMask, Trust Wallet, OKX Wallet, and SafePal
• Stealing data from Exodus, Atomic Wallet, Electrum, Bitcoin Core, and Litecoin Core
• Collecting detailed information about the infected system
• Establishing persistence through scheduled tasks
• Downloading and executing additional payloads

The malware sends stolen information to multiple API endpoints, including:

/api/v1/ext/passwords
/api/v1/ext/tokens
/api/v1/ext/wallets
/api/v1/checkin

Browser Modification and Additional Malware

Psychedelic can terminate selected browser processes and extract an embedded browser extension into browser profiles.

It also uses a native messaging bridge, allowing browser components to communicate with a local host process.

The malware periodically revisits these browser-related operations before contacting its command-and-control infrastructure for additional instructions.

Psychedelic can retrieve tasks through:

/api/v1/agent/tasks?hwid=%s

The hwid value identifies the infected system.

The malware can then execute additional EXE, COM, BAT, CMD, MSI, and PowerShell payloads, giving operators the ability to deploy other malware after the initial infection.

Campaign Infrastructure

Researchers identified an exposed lure management panel associated with the campaign called РУБЛЁВКА TDS (Rublevka TDS).

The panel is hosted on uasputnik[.]com and is separate from the malware's C2 infrastructure.

The panel records visitor interactions with the fake verification page and polls visitor records every two seconds.

At the time of analysis, it recorded:

• 557 views
• 426 clicks
• 79 complete events
• Activity from 32 countries

Ukraine accounted for:

• 446 views
• 351 clicks
• 71 complete events

Other recorded countries included the United States, Poland, Germany, Canada, and the Netherlands.

Russian-language branding and implementation details suggest a possible Russian-speaking development environment, while the use of Ukrainian-language lures and compromised Ukrainian websites indicates a strong focus on Ukrainian users.

ClickFix Campaign Also Delivers RemotePanel and BoundSiphon

Separately, researchers identified another ClickFix campaign delivering two previously undocumented .NET malware components called RemotePanel and BoundSiphon.

RemotePanel

RemotePanel is designed for persistent remote access and provides attackers with capabilities including:

• PowerShell access
• File management
• Process management
• Screen access
• Hidden virtual network computing
• Remote operator control

It disguises itself as the Windows Time service and uses a BNB Smart Chain contract to resolve its C2 infrastructure.

This allows operators to change their backend infrastructure without rebuilding or redeploying the malware.

BoundSiphon

BoundSiphon is primarily loaded directly into memory and focuses on information theft.

It targets:

• Browser credentials
• Browser sessions
• Cryptocurrency wallets
• Password manager data
• Selected documents

It can also target secrets protected by Chromium's App-Bound Encryption.

UAC Bypass and Defender Exclusions

The second ClickFix chain begins with a PowerShell command that launches a multi-stage infection process.

One component abuses the CMSTPLUA COM object to bypass User Account Control and execute a privileged hidden PowerShell process without displaying a UAC prompt.

The attack then configures broad Microsoft Defender exclusions before downloading and executing the additional payloads.

RemotePanel is written to disk and installed as a service for persistence, while BoundSiphon is loaded directly into memory through PowerShell.

The campaign has not been attributed to a known threat actor or group.

However, researchers recovered artifacts suggesting a possible Russian-speaking development environment, including code designed to avoid execution on systems configured with a Russian keyboard layout.

Key Takeaway

The campaigns demonstrate how ClickFix attacks can turn compromised legitimate websites into malware delivery platforms.

The combination of fake Cloudflare verification pages, clipboard manipulation, msiexec.exe, PowerShell, UAC bypasses, browser credential theft, cryptocurrency wallet theft, and persistent remote access makes these attacks particularly dangerous.

Users should never paste commands into Windows Run or PowerShell simply because a website instructs them to complete a security verification. Organizations should also monitor compromised websites, suspicious msiexec.exe and PowerShell activity, unexpected Defender exclusions, scheduled tasks, and unusual browser-profile modifications.