Cybersecurity researchers have uncovered a sophisticated campaign targeting legitimate Ukrainian business websites, injecting fake Cloudflare verification pages to trick visitors into installing malware. Dubbed the “ClickFix” campaign, this operation deploys a previously unseen information-stealing malware called Psychedelic. The campaign has been tied to a pattern of social engineering and domain spoofing that could compromise thousands of unwitting users.
How the ClickFix Deception Works
The attack begins when compromised sites—ranging from clinics and publishers to tool and automotive retailers—insert a malicious iframe that loads a tracker script from an attacker-controlled domain. Visitors are then shown what appears to be legitimate Cloudflare verification pages. These lures provide instructions in Ukrainian, urging users to copy a Windows Installer command to the clipboard and paste it into the “Run” dialog.
Behind the scenes, the fake page delays progression through the interface via a spinner and a delayed “Done” button—creating the illusion of a legitimate process. Once clicked, the installer command retrieves a Windows MSI package (elita.msi, among others), which in turn downloads the main payload: Psychedelic Stealer. Among the files identified are ‘miks.msi’, ‘astra.msi’, ‘harbor.msi’, ‘neon.msi’, ‘sova.msi’, and ‘vyse.msi’; the domain hosting the installer (uasputnik[.]com) was registered as recently as September 9, 2026.
Psychedelic Stealer: What It Does
Once live, Psychedelic Stealer focuses on extracting a wide array of valuable data. It targets passwords stored in Chromium-based browsers (Chrome, Edge, Brave, etc.), account tokens, and cryptocurrency wallet data from both browser extensions (like MetaMask) and standalone desktop apps (such as Electrum or Exodus). It also gathers system information and persistently contacts its command-and-control (C2) server.
An extension archive is dropped into browser profiles, and a native messaging bridge is established, allowing malicious components to communicate with the local system. A recurring task schedule maintains this setup, polling the C2 for new commands. Psychedelic can also run additional malware—EXE, COM, BAT, CMD, MSI, or PowerShell-based—making it potentially part of a larger attack framework.
Additional Payloads & The Bigger Attack Chain
Besides Psychedelic, two more malware tools—RemotePanel and BoundSiphon—have been found later in the ClickFix infection chain. RemotePanel masquerades as the Windows Time service and grants attackers extensive control, including running PowerShell sessions, managing files and processes, screen streaming, and hidden virtual network computing (hVNC). BoundSiphon focuses on credential theft, grabbing browser sessions, wallet data, and sensitive documents, especially those protected by newer Chromium-based security features.
One striking aspect is how these components avoid detection and enable operational flexibility. RemotePanel uses a resolver based on the BNB Smart Chain to hide its C2 infrastructure, allowing operators to swap backend servers without altering the malware itself. BoundSiphon leverages legitimate browser security mechanisms to access protected data that many lesser tools can’t reach.
Attribution, Targets & Global Reach
The campaign’s target set is telling: mostly Ukrainian businesses, with the interface in Ukrainian and viewership concentrated in Ukraine. Russia-linked linguistic and branding markers also suggest the operators may be operating with Russian-speaking infrastructure. Among the recorded metrics: of 557 recorded visitors interacting with the lure interface, 446 were Ukrainian. Other nations—U.S., Poland, Germany, Canada, Netherlands—were also impacted, but at much smaller scales.
The lure setup, managed via a control panel called “Рублёвка TDS” hosted on uasputnik[.]com, tracks visitors’ progress through the fake verification stages. Of the interactions recorded, far fewer “complete events” occurred—likely indicating most users hesitate to follow through with the malicious installer.
What this means: This campaign is a vivid example of how social engineering and domain spoofing remain powerful tools for attackers. By mimicking trusted digital services like Cloudflare, the operators exploit trust and urgency—common in web interactions—to spread malware like Psychedelic Stealer. For users, this underscores the risk of copying and running commands from browsers; for defenders, it demands layered protections including domain monitoring, intrusion detection, and behavioral anomaly tools. Going forward, we should watch for similar campaigns using regional language lures—these may escalate in sophistication if attackers aim more broadly or adapt the payload delivery to evade current defenses.
