The Psychedelic Stealer: When a CAPTCHA Becomes an Installer

Arctic Wolf Labs tracked a campaign that injects iframes into legitimate Ukrainian business websites to display a Ukrainian-language fake Cloudflare verification page that copies an msiexec command to the clipboard; if the victim pastes and runs it, the command retrieves an MSI that installs "Psychedelic Stealer," a 64-bit info-stealer that exfiltrates browser passwords, account tokens, and cryptocurrency-wallet data, deploys browser extensions and native messaging components, creates scheduled-task persistence, and polls a hardcoded C2; the report includes IOCs (domains, IPs, file hashes), lure-panel telemetry (557 views across 32 countries, concentrated in Ukraine), and hunting/detection guidance.