#ParsedReport #CompletenessHigh
26-09-2026

The Psychedelic Stealer: When a CAPTCHA Becomes an Installer

https://arcticwolf.com/resources/blog/psychedelic-stealer-fake-clickfix-captcha-targets-ukraine/

Report completeness: High

Actors/Campaigns:
Rublevka_team

Threats:
Psychedelic_stealer
Clickfix_technique

Victims:
Ukrainian businesses, Hair treatment clinics, Scale model manufacturers, Booksellers and publishers, Psychological facilities, Tool retailers, Automotive retailers, Browser users, Cryptocurrency wallet users

Industry:
Retail, Transport

Geo:
Ukraine, Germany, Poland, Canada, Asia-pacific, United states, Russian, Ukrainian, Americas

TTPs:
Tactics: 3
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1005, T1036, T1041, T1053.005, T1071.001, T1105, T1119, T1189, T1218.007, T1528, have more...

IOCs:
Url: 7
Domain: 1
IP: 3
File: 9
Coin: 2
Hash: 2

Soft:
Cloudflare, Windows Installer, Chrome, Opera, Opera GX, Vivaldi, Chromium, indexeddb

Wallets:
metamask, safepal, atomicwallet, electrum, bitcoincore, litecoincore, exodus_wallet

Crypto:
bitcoin, litecoin

Algorithms:
sha256

Win API:
NS

Win Services:
MsMpEng

Languages:
powershell, php

Links:
https://github.com/rtkwlf/wolf-tools/tree/main/pack\_alerts/202609-ukrainian-clickfix-psychedelic-stealer