The Psychedelic Stealer: When a CAPTCHA Becomes an Installer

Arctic Wolf Labs discovered a campaign that injects iframes into legitimate Ukrainian business websites to display a Ukrainian-language fake Cloudflare verification page which copies an msiexec command to the clipboard; if the victim pastes and runs it, an MSI fetches and installs Psychedelic Stealer, a 64-bit infostealer that harvests browser passwords, account tokens, and cryptocurrency wallet data, deploys browser components, establishes scheduled-task persistence, and polls a remote C2; the report provides IOCs (domains, IPs, file hashes), lure-management telemetry (557 views, 79 completes across 32 countries, concentrated in Ukraine), and hunting/detection guidance.