Psychedelic Stealer Campaign Targets Ukrainian Websites with Fake CAPTCHA

• •Psychedelic Stealer is distributed via compromised Ukrainian websites using a fake CAPTCHA.
• •The malware targets browser credentials and cryptocurrency data, employing a stealthy installation method.
• •The campaign has impacted users across 32 countries, primarily in Ukraine.

A new malware campaign named Psychedelic Stealer is exploiting compromised Ukrainian business websites to deliver a fake Cloudflare CAPTCHA. This lure, presented through injected iframes, directs users to execute a Windows Installer command that downloads the malware. The campaign has affected visitors from 32 countries, with a significant number of interactions recorded from Ukraine. The malware targets sensitive data, including browser passwords and cryptocurrency wallet information, and establishes persistence through scheduled tasks. The attack method bypasses traditional security measures by avoiding PowerShell and using msiexec instead. The lure management panel revealed extensive telemetry data, but it does not confirm successful malware execution. The campaign leverages trusted websites, making it harder for users to identify the threat. As of now, the attack continues, with ongoing monitoring by Arctic Wolf Labs.