> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer - URL: https://f4n6.co.uk/security-feed/hacked-ukrainian-sites-serve-fake-cloudflare-clickfix-lures-for-psychedelic-stealer/ - Published: 2026-09-24T18:33:07.000Z - Updated: 2026-09-24T18:33:07.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary An active ClickFix campaign is compromising legitimate Ukrainian business websites and injecting fake Cloudflare verification pages that lead to a previously undocumented information stealer called Psychedelic. Arctic Wolf Labs, which reported the campaign, says the lure copies an msiexec command to the clipboard and the resulting MSI installer pulls a 64-bit stealer from a hard-coded IP address. The stealer harvests browser credentials, browser account tokens and cryptocurrency wallet data, installs a browser extension with a native-messaging bridge, sets scheduled-task persistence and polls its command-and-control server for further tasking that includes PowerShell and MSI execution. No verified reference data resolved for this item, so no CVSS score and no CISA KEV exploitation state is available, and none is asserted here. For EMEA financial services the direct exposure is credential and session-token theft from staff or customers who browse a compromised site, with follow-on account takeover risk; the campaign is single-sourced to one vendor and no actor attribution has been made. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. This is a threat-intelligence report on a third-party campaign, not an incident at a client, and the trigger facts that would engage DORA Art. 17 to Art. 19 (an ICT-related incident affecting the client's own services) or NIS2 Art. 23 (an incident with a reportable impact) are not present in the source material. DORA Art. 18 and NIS2 Art. 21(2)(d) would become relevant only if a client's own web property were compromised and used to serve the lure, or if the stealer were delivered through a client's ICT third-party chain; neither is established here. ## 3\. Technical analysis & attack chain The chain below is reconstructed from the Arctic Wolf Labs report as relayed by The Hacker News. Steps are confirmed by that reporting; no independent corroboration is available. 1. Legitimate Ukrainian business websites are compromised and an attacker-controlled iframe is injected into their pages. Named victims include a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller and publisher, a psychological facility, a tool retailer and an automotive retailer. The iframe loads attacker JavaScript from `hxxps://fsputnik[.]com/tds/tracker[.]js`. 2. A visitor to the compromised page is shown a page that imitates a Cloudflare verification screen with Ukrainian-language instructions. The clipboard write happens before the lure displays its Windows Run instructions. After a three-second spinner the page presents an instruction dialog and keeps the Done button disabled for roughly 35 further seconds. Arctic Wolf states this delay only controls progression through the lure interface and does not verify that the visitor opened Windows Run, pasted the command or installed the payload. 3. The visitor pastes the copied Windows Installer command into the Windows Run dialog. The command uses `msiexec.exe` to fetch an MSI installer hosted on `uasputnik[.]com`, a domain registered on 9 September 2026\. MSI payloads identified in the campaign are `elita.msi`, `miks.msi`, `astra.msi`, `harbor.msi`, `neon.msi`, `sova.msi` and `vyse.msi`. 4. The MSI installer retrieves the next-stage payload, `psychedeliclove.exe`, from `107.175.82[.]242:9000`. 5. Psychedelic Stealer runs on the host. Its documented capabilities are set out below. Credential and token theft. The stealer collects credentials from Chromium-based browsers including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi and Yandex, and exfiltrates them to the `/api/v1/ext/passwords` endpoint. It separately collects browser-associated account tokens and exfiltrates them to `/api/v1/ext/tokens`. Session tokens are the more consequential of the two for financial services, because a stolen token can be replayed without the password and without triggering a password-based challenge. Wallet theft. The stealer scans for known cryptocurrency wallet browser extensions (MetaMask, Trust Wallet, OKX Wallet, SafePal) and desktop applications (Exodus, Atomic Wallet, Electrum, Bitcoin Core, Litecoin Core), and exfiltrates the recovered data to `/api/v1/ext/wallets`. Host profiling and browser-component handling. The implant captures host information and sends it to `/api/v1/checkin`. It terminates selected browser processes, extracts an embedded extension archive into web browser profiles and sets a native-messaging bridge. Arctic Wolf notes that browser-profile modification and native messaging give deployed browser content a channel to a local host component, and that a recurring background routine revisits extension-related operations before polling the C2 server for tasks. Browser-component handling is therefore part of the implant's ongoing execution cycle, not a one-time installation step. Command-and-control and tasking. The implant polls `/api/v1/agent/tasks?hwid=%s`, where `hwid` is a unique victim identifier. Tasking supports execution of EXE, COM, BAT, CMD, MSI and PowerShell payloads, which gives the operator a route to introduce additional malware after initial access. Persistence. Scheduled-task persistence is documented. The source does not give the task name, the trigger or the binary path used, so no detection content can be written against those specifics. Lure infrastructure. Arctic Wolf identified an exposed lure management panel linked to the campaign, named РУБЛЁВКА TDS (Rublevka TDS), on the `uasputnik[.]com` domain. The source text supplied to Adverse Trace is truncated at this point, so the panel's function, access path and any additional infrastructure it exposes are not available. Confidence and gaps. The entire technical picture rests on a single vendor, Arctic Wolf Labs, as relayed by The Hacker News. No hashes of any MSI or of `psychedeliclove.exe` are provided, so file-identity detection is not possible from this material. No actor or group is named, and no MITRE ATT&CK profile is available for this campaign, so attribution is unconfirmed and Adverse Trace makes none. No verified reference data resolved for this item, which means there is no CVSS score, no severity rating and no CISA KEV state to cross-check the vendor's description against; the discrepancy check that normally accompanies these advisories could not be performed. ## 4\. Mitigation & containment P1 (within 24 hours) - Block `fsputnik[.]com` and `uasputnik[.]com` at DNS resolvers, secure web gateways and email security layers, and block outbound traffic to `107.175.82[.]242`, including TCP port 9000\. These are the only network indicators in the source; treat them as single-sourced and verify against your own telemetry before permanent enforcement. - Hunt for `msiexec.exe` process creation where the command line contains an `http` or `https` URL. Remote MSI installation from a URL is the delivery mechanism here and is rare in normal business use. - Search endpoint telemetry for the file names `psychedeliclove.exe`, `elita.msi`, `miks.msi`, `astra.msi`, `harbor.msi`, `neon.msi`, `sova.msi` and `vyse.msi`. The MSI names are generic enough that a match should be confirmed against the parent process and the download source before you treat it as a true positive. - Review browser profiles on any matching host for extensions that were not installed by the user or by policy, and for native-messaging host registrations that point at an unexpected local binary. The source confirms the implant sets a native-messaging bridge but does not name the extension, the manifest or the host binary, so this review has to be done by inspection rather than by indicator match. - Check for scheduled tasks created around the time of any suspected execution. The source confirms scheduled-task persistence but gives no task name, so enumerate newly created tasks rather than searching for a known string. P2 (within 72 hours) - On any host where `psychedeliclove.exe` executed, treat all browser-stored credentials and all browser session tokens as compromised. Force password resets and revoke active sessions and refresh tokens for the affected identity, including SSO sessions, rather than relying on password change alone. - Rotate any cryptocurrency wallet seed phrases or private keys held on an affected endpoint. The stealer targets both browser extensions and desktop wallet applications, so a browser-only remediation is insufficient. - Review proxy and DNS logs for the `/api/v1/ext/passwords`, `/api/v1/ext/tokens`, `/api/v1/ext/wallets`, `/api/v1/checkin` and `/api/v1/agent/tasks` paths. These are the exfiltration and tasking endpoints and their presence in logs is direct evidence of execution. - Where the implant had time to poll for tasking, assume secondary payload delivery is possible. The tasking channel accepts EXE, COM, BAT, CMD, MSI and PowerShell, so review process creation on the host for anything spawned after the initial infection window. P3 (within 7 days) - Restrict `msiexec.exe` remote installation for standard users through AppLocker or WDAC. This breaks the delivery step for this campaign and for ClickFix lures generally, which all depend on the user pasting a command into the Run dialog. - Apply an extension allowlist to managed browsers so that an extension dropped into a profile by malware is blocked or removed automatically. - Brief staff on the ClickFix pattern: a page that asks them to copy a command and paste it into Windows Run is never a legitimate verification step, regardless of how the page is branded. The fake Cloudflare branding and the Ukrainian-language instructions are the specific lures in this campaign. - Add the exfiltration endpoint paths to web-proxy alerting so that a future variant using different domains still generates a detection. ## 5\. Indicators of compromise All indicators below come from a single source, Arctic Wolf Labs as relayed by The Hacker News. No hashes were published. Verify before enforcement. | type | value | confidence | source | | -------- | ------------------------------------------- | --------------------- | ------------------------------------ | | domain | fsputnik\[.\]com | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | domain | uasputnik\[.\]com | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | url | hxxps://fsputnik\[.\]com/tds/tracker\[.\]js | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | ipv4 | 107.175.82\[.\]242:9000 | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | filename | psychedeliclove.exe | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | filename | elita.msi | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | filename | miks.msi | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | filename | astra.msi | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | filename | harbor.msi | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | filename | neon.msi | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | filename | sova.msi | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | filename | vyse.msi | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | uri | /api/v1/ext/passwords | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | uri | /api/v1/ext/tokens | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | uri | /api/v1/ext/wallets | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | uri | /api/v1/checkin | high (single-sourced) | Arctic Wolf Labs via The Hacker News | | uri | /api/v1/agent/tasks?hwid=%s | high (single-sourced) | Arctic Wolf Labs via The Hacker News | ```iocs domain fsputnik[.]com domain uasputnik[.]com url hxxps://fsputnik[.]com/tds/tracker[.]js ipv4 107.175.82[.]242:9000 filename psychedeliclove.exe filename elita.msi filename miks.msi filename astra.msi filename harbor.msi filename neon.msi filename sova.msi filename vyse.msi uri /api/v1/ext/passwords uri /api/v1/ext/tokens uri /api/v1/ext/wallets uri /api/v1/checkin uri /api/v1/agent/tasks?hwid=%s ``` Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | --------------------------------------------------------- | | msiexec.exe launched with an HTTP or HTTPS URL in the command line, following a user paste into the Run dialog | process creation telemetry, EDR | high (single-sourced) | | Outbound connection to TCP port 9000 on a bare IP address | firewall, netflow, EDR network telemetry | high (single-sourced) | | Browser processes terminated, then an extension archive written into a browser profile | EDR process telemetry, file integrity monitoring on browser profile directories | high (single-sourced) | | Native-messaging host registration created or modified outside a change window | browser profile inspection, endpoint configuration monitoring | medium (mechanism confirmed, no artefact named in source) | | Scheduled task created shortly before or after the browser activity above | Windows task scheduler logs, EDR | medium (persistence confirmed, no task name in source) | | Repeated polling of a single host identifier against a tasking endpoint | web proxy, DNS, TLS inspection | high (single-sourced) | ## 6\. Detection The YARA rule below uses strings taken from the campaign's own artefacts: the second-stage executable name, the exfiltration and tasking endpoint paths, the two delivery domains and the MSI file names. It is written to match either the MSI installer or the dropped executable. ```yara rule Psychedelic_Stealer_ClickFix_Artifacts { meta: author = "Adverse Trace" date = "2026-09-24" reference = "https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html" description = "Strings associated with Psychedelic Stealer and its ClickFix MSI delivery chain" confidence = "single-sourced, Arctic Wolf Labs via The Hacker News" strings: $exe = "psychedeliclove.exe" ascii wide $api1 = "/api/v1/ext/passwords" ascii wide $api2 = "/api/v1/ext/tokens" ascii wide $api3 = "/api/v1/ext/wallets" ascii wide $api4 = "/api/v1/checkin" ascii wide $api5 = "/api/v1/agent/tasks?hwid=" ascii wide $dom1 = "fsputnik" ascii wide $dom2 = "uasputnik" ascii wide $msi1 = "elita.msi" ascii wide $msi2 = "miks.msi" ascii wide $msi3 = "astra.msi" ascii wide $msi4 = "harbor.msi" ascii wide $msi5 = "neon.msi" ascii wide $msi6 = "sova.msi" ascii wide $msi7 = "vyse.msi" ascii wide condition: filesize < 50MB and 3 of them } ``` The Sigma rule below targets the delivery step. It fires on `msiexec.exe` being invoked with a remote URL, which is how the ClickFix command retrieves the MSI. Tune the filter to your environment's software deployment tooling before enabling. ```yaml title: ClickFix msiexec Remote MSI Execution id: 8f2c1a44-5b7e-4d19-9c3a-psychedelic01 status: experimental description: Detects msiexec.exe fetching and installing an MSI package from a remote URL, the delivery step used by the Psychedelic ClickFix campaign references: - https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html author: Adverse Trace date: 2026/09/24 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: '\msiexec.exe' selection_remote: CommandLine|contains: - 'http://' - 'https://' filter_local: CommandLine|contains: - '\\' - 'C:\' condition: selection_img and selection_remote and not filter_local falsepositives: - Legitimate software deployment platforms that install MSI packages from an internal HTTP source level: high ``` A second rule covers the C2 channel. The stealer contacts a bare IP on TCP port 9000, which is unusual for legitimate browser or installer traffic. ```yaml title: Outbound Connection to Psychedelic Stealer C2 Port id: 3d9b7e21-6a4f-4c88-b1d2-psychedelic02 status: experimental description: Detects outbound network connections to TCP port 9000 on the IP address used to host the Psychedelic Stealer second stage references: - https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html author: Adverse Trace date: 2026/09/24 logsource: category: network_connection product: windows detection: selection: DestinationIp: '107.175.82.242' DestinationPort: 9000 condition: selection falsepositives: - Unlikely level: critical ``` ## 7\. Sources - The Hacker News, "Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer", https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html, published 2026-09-24. - Arctic Wolf Labs technical report, cited by The Hacker News as the origin of the technical findings. No URL for this report was present in the source material supplied to Adverse Trace, so it cannot be linked directly. ## 8\. Adverse Trace position Adverse Trace assesses this as a credential and session-token theft campaign with a moderate priority for EMEA financial services. No verified reference data resolved for this item, so we assign no CVSS score, no severity rating and no CISA KEV exploitation state, and clients should not read a severity into this advisory that the underlying data does not support. The direct impact on a financial institution is indirect: staff or customers who reach a compromised site can lose browser credentials, live session tokens and wallet keys, and the tasking channel allows the operator to push further payloads onto an infected endpoint. The campaign is single-sourced to Arctic Wolf Labs, no actor is named, and no hashes were published, so the indicator set in §5 should be treated as provisional and verified against local telemetry before permanent blocking. We will monitor for additional vendor reporting that corroborates the infrastructure, for hashes of the MSI and second-stage samples, and for any expansion of the compromised-site set beyond Ukrainian businesses; we will reissue this advisory if the attribution picture or the indicator set materially changes. --- [Read the original source →](https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*