{"id":1993,"date":"2026-09-25T13:59:28","date_gmt":"2026-09-25T08:29:28","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1993"},"modified":"2026-09-29T12:23:51","modified_gmt":"2026-09-29T06:53:51","slug":"ukrainian-business-sites-become-clickfix-launchpads-for-psychedelic-stealer","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/ukrainian-business-sites-become-clickfix-launchpads-for-psychedelic-stealer\/","title":{"rendered":"Ukrainian Business Sites Become ClickFix Launchpads for Psychedelic Stealer"},"content":{"rendered":"

Psychedelic Stealer is reaching Windows endpoints through compromised Ukrainian business websites displaying fake Cloudflare verification prompts. The campaign uses ClickFix social engineering to persuade visitors to run a Windows Installer command, turning a routine browsing session into a malware installation.<\/p>\n

For security administrators, the concern extends beyond suspicious websites. Employees can encounter malicious instructions on legitimate business pages. Defenses must address what happens when a user transfers those instructions from the browser into the operating system.<\/p>\n

How the Psychedelic Stealer attack chain works<\/h2>\n

Attackers injected an iframe into legitimate websites, including retailers and healthcare-related businesses. The injected content references attacker-controlled JavaScript at fsputnik[.]com\/tds\/tracker[.]js and presents a fake Cloudflare verification flow.<\/p>\n

When visitors interact with the lure, it copies an msiexec.exe command to their clipboard. Instructions then direct them to paste it into Windows Run and execute it. The command retrieves a malicious MSI package, which delivers the stealer. Visiting the page alone does not establish infection: the chain depends on user execution.<\/p>\n

This distinction should shape triage. Ask whether the employee merely saw the prompt, copied its contents, or actually executed the command. Record the browsing time and affected device, then correlate the report with endpoint evidence.<\/p>\n

What Psychedelic Stealer does after execution<\/h3>\n

The malware collects browser passwords, account tokens, cryptocurrency wallet data, and host information. It also establishes scheduled-task persistence and polls command-and-control infrastructure for further instructions, creating a route for additional payload execution.<\/p>\n

Arctic Wolf identified the scheduled task psychedelicloveUtils and payload psychedeliclove.exe. These provide investigation leads alongside the delivery infrastructure. However, token collection does not establish successful account takeover; Arctic Wolf did not observe successful takeover during its investigation.<\/p>\n

\n
\n
\n
\n \"cybersecurity-kit\"\n <\/div>\n <\/div>\n
\n
\n Featured Resource\n <\/h5>\n

\n Cybersecurity kit\n <\/h4>\n

\n Access essential cybersecurity resources to strengthen security, reduce risk, and improve cyber resilience.\n <\/p>\n \n Download the Resource Kit\n \n \n \n \n <\/g>\n <\/svg>\n\n <\/a>\n <\/div>\n <\/div>\n <\/section>\n

What security teams should investigate<\/h2>\n

Build the investigation around execution context. Review installer command lines, download destinations, spawned processes, and activity around the reported browsing session. Correlate these findings with scheduled-task creation, browser-profile changes, and outbound connections.<\/p>\n

Treat individual indicators as starting points. An installer process or scheduled task needs context before an analyst can classify it as malicious. Compare suspicious activity with approved software deployment records and expected administrative work.<\/p>\n

Use the investigation to answer three operational questions:<\/p>\n