Psychedelic Stealer via fake Cloudflare

Summary

Arctic Wolf Labs published this on 24 September 2026 about an ongoing campaign aimed chiefly at Ukrainian users. Hacked websites of real Ukrainian businesses, a hair clinic and a bookseller among them, carry an injected iframe that loads a Ukrainian-language imitation of a Cloudflare check. A click copies an msiexec command, which the visitor is then walked through running from Win+R, so an MSI installs straight from the attackers' domain, registered on 9 September, rather than through the usual PowerShell one-liner. The package fetches a previously unknown stealer Arctic Wolf names Psychedelic after an embedded tag. It takes browser passwords, account tokens and wallet data, plants browser components with a native-messaging bridge, persists through a scheduled task and polls its server for more tasks. An exposed lure panel with Russian branding logged 557 page views from 32 countries, most of them from Ukraine.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

No other campaign on record combines them. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

10 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.