Psychedelic Stealer — ClickFix Fake-Cloudflare Campaign

Arctic Wolf Labs is tracking an ongoing campaign that compromises legitimate Ukrainian business websites (a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller/publisher, a psychological facility, a tool retailer, and an automotive retailer) and injects an iframe that loads a fake, Ukrainian-language Cloudflare "human verification" page. Instead of the usual encoded PowerShell ClickFix payload, this campaign poisons the clipboard with a msiexec.exe /i <url>.msi /passive command and instructs the visitor to paste it into the Windows Run dialog. The MSI retrieves a previously undocumented 64-bit Windows infostealer that Arctic Wolf named Psychedelic Stealer after its embedded configuration tag. The implant harvests Chromium browser passwords, account tokens, and cryptocurrency-wallet data (browser-extension and desktop-wallet), installs a browser native-messaging bridge, persists via a logon-triggered scheduled task named psychedelicloveUtils, and polls a hardcoded C2 for further tasking (including arbitrary EXE/MSI/PowerShell execution).

The attacker's own operational infrastructure is short-lived and same-day: the delivery domain uasputnik[.]com was registered 2026-09-09 and lure activity was already observed within days. An exposed lure-management panel (branded "РУБЛЁВКА TDS" / Rublevka TDS) recorded 557 views, 426 clicks and 79 "complete" events across 32 countries, 446/351/71 of them from Ukraine, confirming the Ukraine-focused targeting.

The attacker's highest point of leverage is the moment the victim executes a Windows-Installer command they pasted themselves: it bypasses browser and mail-gateway file-download controls entirely. The defender's highest point of leverage is the same moment, from the other side: a Run-dialog-parented msiexec.exe invoking a remote, non-corporate MSI URL is a rare, high-fidelity, one-line detection that predates payload execution, persistence, and theft altogether (Section 8, Q1).

Web-hunter decisions

• Every atomic indicator shipped in this pack (hashes, IPs, domains, filenames, task name, extension IDs) is drawn verbatim from the Arctic Wolf and/or The Hacker News snapshots. Nothing from the Techzine summary or from general knowledge was used to originate an indicator.
• Arctic Wolf explicitly frames its interaction telemetry (view/click/"complete") as not proof of execution or compromise; this pack preserves that caveat rather than treating panel "complete" events as confirmed infections (see Section 3).
• No prompt-injection or embedded instructions directed at an AI/automation tool were found in either fetched source. Both read as ordinary vendor/press technical prose.

Hunt hypotheses (ordered by fidelity)

1. H1 (high): msiexec.exe is launched with explorer.exe as its parent (Windows Run dialog) and a command line containing a remote HTTP(S) MSI URL. This is the single highest-value signal in the whole chain: it fires before payload execution, is rare in normal enterprise use, and directly corresponds to how the campaign forces execution.
2. H2 (high): A msiexec.exe /passive install carries the campaign's distinctive ORG_NOTE= MSI property containing the Ukrainian "verification" text — a string unique to this lure's clipboard payload.
3. H3 (high): A process or file named psychedeliclove.exe executes, or the confirmed SHA-256 is observed.
4. H4 (high): A logon-triggered scheduled task named psychedelicloveUtils is registered — the implant's sole documented persistence mechanism.
5. H5 (high): A host makes an outbound connection to the hardcoded implant C2 (193.178.159.128:8080) or the next-stage payload host (107.175.82.242:9000).
6. H6 (medium): A host resolves the delivery domain uasputnik[.]com or the iframe-loader domain fsputnik[.]com — useful as an early pivot but weaker alone (DNS resolution does not prove the MSI was fetched or executed).
7. H7 (medium): Native-messaging bridge artifacts (host.ps1, host.bat, com.lunex.explorer.json) are written to a browser profile directory.
8. H8 (medium): A non-browser process reads Chromium credential stores (Login Data, Web Data, Local State) or known wallet-extension storage paths.

Attack chain

Note on the lure-management panel: Arctic Wolf explicitly states panel "view", "click" and "complete" events measure interaction with the web lure only and do not independently confirm clipboard success, command execution, or host compromise. This pack does not treat panel telemetry as confirmed infection evidence anywhere below.

For hosts without Falcon coverage, or to cross-validate Section 8, use native Windows / infrastructure logging:

• Windows Security Event ID 4688 (process creation, requires command-line auditing enabled): filter New Process Name = msiexec.exe, Creator Process Name = explorer.exe, command line containing /passive or an http(s):// URL.
• MsiInstaller Event ID 1040/1042 (Application log): captures the source of an MSI install, including a remote URL source, independent of Falcon.
• Task Scheduler Operational log Event ID 4698 (task registered): filter Task Name containing psychedelicloveUtils.
• Sysmon (hosts without EDR): Event ID 1 (Process Create) for the msiexec/psychedeliclove.exe pattern, Event ID 3 (Network Connect) for the two C2/staging IPs, Event ID 11 (File Create) for host.ps1/host.bat/com.lunex.explorer.json.
• DNS resolver / secure web gateway logs: query for resolutions of uasputnik.com and fsputnik.com even where Falcon DnsRequest telemetry is unavailable or disabled.
• Chrome/Edge enterprise policy compliance report: verify the ClipboardAllowedForUrls / DefaultClipboardSetting policy (Section 13, Playbook 1) is actually applied fleet-wide — this is the compensating control for the sensor-blind clipboard step.
• Web-hosting / CMS audit trail (for MSPs or businesses hosting client-facing sites of the small-business profile this campaign targets): review file-integrity-monitoring alerts or CMS admin/audit logs for unauthorized template or iframe modifications. This is the only realistic detection point for the initial iframe injection step, which no endpoint sensor observes.

IOA candidates

Alert package — DETECT: ClickFix msiexec Remote MSI via Run Dialog (Q1)

Scheduled Search description: Fires when msiexec.exe is spawned directly from the Windows Run dialog (parent explorer.exe) with a command line requesting a remote HTTP(S) MSI. This is the earliest reliable detection point in the Psychedelic Stealer chain and generalizes to other ClickFix-via-msiexec campaigns.

Alert email subject: [HIGH] Detection: Psychedelic Stealer ClickFix -- Run-dialog msiexec fetching remote MSI

Alert email body: A host executed msiexec.exe as a direct child of explorer.exe (consistent with a Windows Run dialog paste) referencing a remote MSI package over HTTP(S). This matches the delivery mechanism of the Psychedelic Stealer / fake-Cloudflare ClickFix campaign (Arctic Wolf Labs, 2026-09-24): the user was very likely shown a fake CAPTCHA/verification page and instructed to paste this command. Immediate actions: (1) network-isolate the host pending triage, (2) capture the full command line and the referenced MSI URL/hash, (3) check for a subsequent psychedeliclove.exe execution or connections to 107.175.82.242:9000 / 193.178.159.128:8080, (4) if either is present, treat browser-stored credentials and any crypto wallets on the host as compromised and begin credential rotation.

Triage checklist

1. Pull the full CommandLine and confirm the referenced MSI URL/domain against the IOC table (Section 4).
2. Check whether the MSI actually installed (subsequent child processes of msiexec.exe, or a new file matching a known MSI name).
3. Run Q4 for the same aid to check for psychedeliclove.exe execution.
4. Run Q5 for the same aid to check for psychedelicloveUtils scheduled-task creation.
5. Run Q6 for the same aid to check for connections to either C2/staging IP.
6. If any of the above hit: treat all browser-saved credentials, session tokens, and any cryptocurrency wallets present on the host as compromised; force credential rotation and revoke active sessions for affected accounts.
7. Interview the user: which site were they on, did they see a "human verification" prompt, did they paste a command into Run.
8. If the referenced site is one your organization or an MSP client hosts, notify the site owner — it is likely compromised and serving the injected iframe to other visitors right now.

Pivot queries

• Host-scoped: re-run Q1, Q4, Q5, Q6, Q8, Q9 filtered to the alerting aid across a 30-day window to reconstruct the full timeline.
• Environment-wide: run Q6 and Q7 fleet-wide to find any other host that has ever talked to the campaign's C2/staging infrastructure or resolved its domains, even without an initial Q1 hit (covers hosts where the msiexec step predates this pack's deployment).

Q2, Q3, Q7, Q8, Q9 are investigate-only (hunt/pivot); no alert email is generated for them — they exist to enrich and corroborate a Q1/Q4/Q5/Q6 hit, not to page on their own.

Grouped, one-click indicator blocks. All values below are drawn from the saved source snapshots (Section 2 / Section 18) and trace to Psychedelic-Stealer-ClickFix-Hunt-sources/.

type,value,action,severity,expiration,description,tags
domain,uasputnik.com,detect,high,2027-03-25,Psychedelic Stealer lure/panel/MSI-delivery hostname,campaign:PsychedelicStealer
domain,fsputnik.com,detect,high,2027-03-25,Psychedelic Stealer injected-iframe JS loader,campaign:PsychedelicStealer
ipv4,107.175.82.242,detect,high,2027-03-25,Psychedelic Stealer next-stage payload host (TCP 9000),campaign:PsychedelicStealer
ipv4,193.178.159.128,detect,high,2027-03-25,Psychedelic Stealer implant C2 (TCP 8080),campaign:PsychedelicStealer
ipv4,176.53.159.40,hunt,medium,2026-12-25,A-record association with uasputnik.com 2026-09-09 to 2026-09-14,campaign:PsychedelicStealer
url,https://uasputnik.com/elita.msi,detect,high,2027-03-25,Psychedelic Stealer first-stage MSI download URL,campaign:PsychedelicStealer
sha256,38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878,detect,high,2027-03-25,elita.msi installer hash,campaign:PsychedelicStealer
sha256,06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90,detect,high,2027-03-25,psychedeliclove.exe stealer payload,campaign:PsychedelicStealer
filename,psychedeliclove.exe,detect,high,2027-03-25,Psychedelic Stealer final payload filename,campaign:PsychedelicStealer

# Run-dialog msiexec fetching a remote MSI (primary signal, see Q1)
FileName=/^msiexec\.exe$/i ParentBaseFileName=/^explorer\.exe$/i CommandLine=/\/i\s+["']?https?:\/\//i

# msiexec with the campaign's ORG_NOTE lure property (see Q2)
FileName=/^msiexec\.exe$/i CommandLine=/\/passive/i CommandLine=/ORG_NOTE=/i

# Logon-trigger scheduled task persistence (see Q5)
#event_simpleName=ScheduledTaskRegistered TaskName=/psychedelicloveUtils/i

psychedeliclove.exe          - final stealer payload (64-bit)
elita.msi / miks.msi / astra.msi / harbor.msi / neon.msi / sova.msi / vyse.msi  - observed first-stage MSI filenames
psychedelicloveUtils          - logon scheduled task (persistence)
com.lunex.explorer(.json)     - native-messaging bridge name / manifest
host.ps1 / host.bat           - bridge component files (generic names, corroborate before acting)
executed_tasks.json           - local C2 task-state tracking artifact
<<BP_INSTALLER_HWID>>             - placeholder patched into deployed browser components
РУБЛЁВКА TDS / Rublevka TDS   - lure-management panel branding

# Confirm Chrome clipboard-write policy is enforced (Playbook 1)
reg query "HKLM\SOFTWARE\Policies\Google\Chrome" /v DefaultClipboardSetting

# Confirm the msiexec outbound-firewall rule exists (Playbook 2)
Get-NetFirewallRule -DisplayName "Block-Msiexec-Outbound" | Select-Object Enabled,Action,Direction

# Audit currently registered scheduled tasks for the campaign task name (Playbook 3 / Q5 cross-check)
schtasks /query /fo LIST /v | Select-String -Pattern "psychedelicloveUtils"

Controls are tiered by deployment friction and cover the three surfaces this threat actually touches: the Windows endpoint, the Chromium browser, and DNS/network egress. A fourth surface, the web-hosting layer that hosts the compromised business sites, is out of scope for endpoint tooling and is called out separately.

Playbook 1 — Block programmatic clipboard writes from untrusted origins (Chrome/Edge)

Prerequisites: Chrome/Edge managed via Group Policy ADMX templates or Chrome Browser Cloud Management; identify any internal web apps that legitimately use navigator.clipboard.writeText so they can be allowlisted before enforcement.
Reboot required: No — browser restart only.
Rollback: Remove or set the GPO value back to "Not Configured" and force a policy refresh (gpupdate /force); the browser reverts to its default clipboard-permission prompt behavior.

' GPO path: Computer Configuration > Administrative Templates > Google Chrome > Content Settings
' Or Edge: Computer Configuration > Administrative Templates > Microsoft Edge > Content Settings > Clipboard

' Registry equivalent (deploy via GPO Preference or Intune):
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v DefaultClipboardSetting /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v ClipboardAllowedForUrls /t REG_SZ /d "[\"https://*.yourorg.com\"]" /f

' Edge equivalent:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v DefaultClipboardSetting /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v ClipboardAllowedForUrls /t REG_SZ /d "[\"https://*.yourorg.com\"]" /f

' DefaultClipboardSetting=2 blocks clipboard read/write by default for all sites not on the allow list.

Playbook 2 — Restrict msiexec.exe to internal/signed sources and block its outbound network access

Prerequisites: Inventory legitimate remote-MSI deployment tooling (SCCM, Intune, third-party RMM) and its source IP ranges/hostnames before enabling; test on a pilot ring.
Reboot required: No.
Rollback: Remove-NetFirewallRule -DisplayName "Block-Msiexec-Outbound" and remove/disable the AppLocker MSI rule via gpupdate /force after unlinking the GPO.

# Windows Firewall: block msiexec.exe outbound except to your internal deployment server range
New-NetFirewallRule -DisplayName "Block-Msiexec-Outbound" -Direction Outbound `
  -Program "%SystemRoot%\System32\msiexec.exe" -Action Block -Enabled True
New-NetFirewallRule -DisplayName "Allow-Msiexec-Internal-Deploy" -Direction Outbound `
  -Program "%SystemRoot%\System32\msiexec.exe" -RemoteAddress 10.0.0.0/8 -Action Allow -Enabled True

# AppLocker: restrict Windows Installer rules to a trusted internal path (deploy via GPO)
New-AppLockerPolicy -RuleType Msi -User Everyone -FilePathCondition "%OSDRIVE%\ApprovedInstalls\*" `
  -Generate | Set-AppLockerPolicy -Merge

Playbook 3 — Block confirmed campaign infrastructure and import IOCs into Falcon

Prerequisites: Falcon Insight/XDR API credentials with IOC-management write scope, or console access to IOC Management; DNS RPZ (or equivalent) zone available on your resolver.
Reboot required: No.
Rollback: Delete the imported IOCs from Falcon IOC Management, and remove the RPZ zone entries; both actions take effect immediately with no endpoint-side state to revert.

# Falcon: import Section 10's grab-csv block via IOC Management > Upload / API
# (falconpy example)
from falconpy import IOC
falcon = IOC(client_id="REPLACE_WITH_CLIENT_ID", client_secret="REPLACE_WITH_CLIENT_SECRET")
# NOTE: action=detect matches the Section 4 IOC table and the Section 10 CSV exactly.
# Do NOT raise these to action="prevent" on the strength of this pack alone. All four
# values are single-sourced to the Arctic Wolf report (The Hacker News corroborates the
# victim-site list and the MSI filenames, not the C2 infrastructure), and both IPs sit on
# commodity hosting where addresses get reassigned. Promote to prevent only after (a) a
# second independent source confirms the infrastructure is still attacker-controlled and
# (b) you have confirmed no legitimate destination shares the address in your own egress
# logs. See the promotion row in Section 11.
falcon.indicator_create(body={
  "indicators": [
    {"type": "domain", "value": "uasputnik.com", "action": "detect", "severity": "high",
     "platforms": ["windows"], "source": "Psychedelic Stealer HuntPack"},
    {"type": "domain", "value": "fsputnik.com", "action": "detect", "severity": "high",
     "platforms": ["windows"], "source": "Psychedelic Stealer HuntPack"},
    {"type": "ipv4", "value": "107.175.82.242", "action": "detect", "severity": "high",
     "platforms": ["windows"], "source": "Psychedelic Stealer HuntPack"},
    {"type": "ipv4", "value": "193.178.159.128", "action": "detect", "severity": "high",
     "platforms": ["windows"], "source": "Psychedelic Stealer HuntPack"}
  ]
})

# DNS RPZ zone entry (BIND-style) to null-route the delivery/loader domains
uasputnik.com    CNAME   .
fsputnik.com     CNAME   .

Validation gates for every query above are tracked in Section 11; two techniques above are genuine, honestly-flagged sensor gaps (browser-side delivery) rather than missed detections, and are addressed only through the compensating controls in Section 12/13.

Note: coverage from dev.ua was searched for but could not be fetched (HTTP 403 on every direct attempt, no archived snapshot available) and is not cited anywhere in this pack. See Section 2 for the full source-access log.