The Psychedelic Stealer: When the CAPTCHA Is the Installer

The Psychedelic Stealer campaign involved compromising legitimate Ukrainian small-business websites to present a fake Cloudflare CAPTCHA page that convinced users to manually run msiexec.exe commands. This led to installation of the Psychedelic malware, which combines credential theft and persistent agent capabilities. It installs browser extensions that use native-messaging bridges, sets scheduled tasks, and polls a REST API for arbitrary executable tasking. The malware targets browser credentials, session tokens, and cryptocurrency wallets such as MetaMask, Trust Wallet, Exodus, Atomic Wallet, and others. The campaign avoids using encoded PowerShell scripts and instead leverages signed Microsoft binaries to bypass common detection mechanisms associated with ClickFix attacks. The infection rate was approximately 14%, with 79 infections from 426 clicks. The operation is financially motivated and focused primarily on Ukrainian victims.

The Psychedelic Stealer campaign results in theft of sensitive browser credentials, session tokens, and cryptocurrency wallet data, enabling financial theft from victims. The malware establishes persistence on infected systems via browser extensions and scheduled tasks, allowing ongoing control and arbitrary code execution through a REST API. The use of signed Microsoft binaries to bypass detection increases the likelihood of successful infection and evasion of security controls. The targeting of Ukrainian small-business websites and cryptocurrency users indicates a focused financially motivated threat. The infection rate of 14% from clicks demonstrates moderate effectiveness of the social engineering technique.

No official patch or vendor advisory is available for this malware campaign. Mitigation should focus on user education to avoid executing unsolicited msiexec.exe commands, especially those prompted by suspicious CAPTCHA or verification pages. Network defenders should monitor for indicators of compromise such as the listed domains (uasputnik.com, fsputnik.com), IP addresses, URLs, and file hashes associated with Psychedelic. Blocking access to these domains and URLs and scanning for the identified hashes can help reduce infection risk. Because the malware uses signed Microsoft binaries for execution, traditional signature-based detection may be less effective, so behavioral and heuristic detection methods should be employed. Users should verify website authenticity before interacting with CAPTCHA or verification prompts and avoid manual execution of commands from untrusted sources.