Criminals have launched a large-scale campaign using the ClickFix social engineering technique, attacking legitimate web resources of Ukrainian enterprises and organizations. The main goal of the attack is to force users to manually execute a malicious command and infect devices with a new spyware called Psychedelic Stealer, designed to steal passwords and crypto wallets.
Criminals have launched a large-scale campaign using the ClickFix social engineering technique, attacking legitimate web resources of Ukrainian enterprises and organizations. The main goal of the attack is to force users to manually execute a malicious command and infect devices with a new spyware called Psychedelic Stealer, designed to steal passwords and crypto wallets.
The criminals are injecting a malicious iframe script (fsputnik[.]com/tds/tracker[.]js) into the code of the hacked sites. The victims of the hack included Ukrainian resources of various profiles: a hair treatment clinic, a scale model manufacturer, a specialized publishing house, a psychological center, as well as tool and auto parts stores, The Hacker News reports .
When visiting a compromised site, the user is shown a fake Cloudflare verification page with instructions in Ukrainian.
The MSI package downloads and runs the main 64-bit executable psychedeliclove.exe. Researchers from Arctic Wolf Labs have discovered that Psychedelic Stealer has a wide range of spying capabilities.
Credential collection: steals saved passwords and authorization tokens from all popular Chromium browsers (Chrome, Edge, Brave, Opera, Vivaldi, Yandex) and sends them to a C2 server.
Crypto Wallet Hunt: Scans the system for browser extensions (MetaMask, Trust Wallet, OKX, SafePal) and desktop applications (Exodus, Atomic Wallet, Electrum, Bitcoin Core, Litecoin Core).
Browser profile modification: closes browser processes, unpacks its own malicious extensions into user profiles, and configures Native Messaging for constant background communication between the browser and the malware.
Execution of additional commands: Requests new tasks via the C2 server using the victim's unique HWID, allowing operators to remotely run any EXE, BAT, CMD, or PowerShell files.
Arctic Wolf specialists discovered an open traffic control panel on the uasputnik[.]com domain. Of the 557 recorded views and 426 clicks, over 80% were from users from Ukraine (446 views and 351 clicks). The panel interface and technical artifacts have Russian branding, indicating the group’s likely Russian origin.
In parallel, researchers from Blackpoint Cyber have detected another branch of attacks using the ClickFix mechanism, which installs two new .NET-based modules into the system at once:
RemotePanel: A remote access trojan (RAT) that masquerades as the Windows Time system service. It gives hackers full control over the PC: remote desktop access (hVNC), execution of PowerShell scripts, file and process management. To find the C2 server, the tool uses a smart contract on the BNB Smart Chain, which allows changing IP addresses without rebuilding the virus itself.
BoundSiphon: A session, password, and document stealing module that loads directly into RAM. It is capable of bypassing App-Bound Encryption protection in modern versions of Chromium.
To elevate privileges, this bundle uses UAC bypass via the CMSTPLUA COM object, then adds the entire disk to Microsoft Defender exceptions. Keyboard layout checks were found in the RemotePanel and BoundSiphon code - the malware stops working if the Russian language is present in the system.
