# Cyberattack Wave Targets Ukrainian Businesses Through Malicious ClickFix Campaigns
## Overview
Cybersecurity researchers have uncovered a large-scale malicious campaign that has been exploiting legitimate Ukrainian business websites to deploy a newly identified information-stealing malware. The operation, which leverages social engineering through fake browser verification prompts, has drawn attention for its sophisticated multi-stage delivery mechanism and its apparent focus on targeting users in Ukraine.
## How the Attack Works
The threat begins when a user visits one of the compromised business websites — ranging from hair-treatment clinics and automotive retailers to bookshops and psychological service providers. An injected iframe on these pages silently executes attacker-controlled JavaScript that presents a forged Cloudflare verification screen to the visitor.
The screen displays instructions in Ukrainian and attempts to deceive the user into pasting a seemingly harmless Windows command into the Run dialog. Specifically, the lure copies an “msiexec.exe” command to the clipboard and directs the user to execute it. A three-second loading spinner appears before the instruction dialog is shown, and the confirmation button remains inactive for an additional 35 seconds — a designed delay meant to pressure the user into completing the action without questioning it.
Critically, this waiting period is purely cosmetic. It does not confirm whether the user actually opened the Run dialog, pasted the command, or proceeded with installation.
## The Malware: Psychedelic Stealer
Once the user follows the instructions, a Windows MSI installer is downloaded and executed. This installer retrieves a second-stage payload known as **Psychedelic Stealer**, a 64-bit Windows executable previously unknown to security researchers.
Psychedelic Stealer is engineered to collect a wide range of sensitive data, including:
– **Browser credentials** from Chromium-based browsers such as Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex
– **Account tokens** associated with browser sessions
– **Cryptocurrency wallet data** from both browser extensions (MetaMask, Trust Wallet, OKX Wallet, SafePal) and desktop applications (Exodus, Atomic Wallet, Electrum, Bitcoin Core, and Litecoin Core)
– **Comprehensive host information** about the infected machine
Beyond initial data collection, the malware modifies browser profiles, installs native messaging bridges, and establishes a persistent connection to a command-and-control server. A recurring background process continues to manage browser extensions and polls the C2 server for additional commands, allowing the attackers to issue further payloads — including EXE, COM, BAT, CMD, MSI, and PowerShell files — at any time.
## Infrastructure and Command-and-Control
The MSI payload is hosted on a domain registered in September 2026, with several other installer files also identified on the same infrastructure, including “miks.msi,” “astra.msi,” “harbor.msi,” “neon.msi,” “sova.msi,” and “vyse.msi.” The C2 server used by Psychedelic Stealer operates on a separate IP address, and investigators also discovered an exposed lure management panel linked to the campaign, which tracks visitor interactions in near-real time.
At the time of analysis, the dashboard logged over 557 page views and 426 clicks across 32 countries, with the overwhelming majority originating from Ukraine. This geographic concentration, combined with Russian-language artifacts found in the campaign’s code, has led researchers to assess that the operation was primarily aimed at Ukrainian users.
## Additional Findings: RemotePanel and BoundSiphon
In a separate but related discovery, cybersecurity firm Blackpoint Cyber identified another ClickFix-based campaign distributing two previously undocumented .NET malware components: **RemotePanel** and **BoundSiphon**.
RemotePanel functions as a persistent remote access tool, masquerading as the Windows Time service to maintain a foothold on infected systems. It provides operators with extensive control, including interactive PowerShell sessions, file and process management, screen streaming, and modular hidden virtual network computing (hVNC). Notably, RemotePanel uses a BNB Smart Chain smart contract to dynamically resolve its command-and-control server, enabling operators to change infrastructure without modifying the malware itself.
BoundSiphon, meanwhile, operates primarily in memory and targets browser credentials, session tokens, cryptocurrency wallets, password manager data, and protected documents. It leverages Chromium’s App-Bound Encryption mechanism to access newer browser-stored secrets and has been linked to malicious NuGet packages reported earlier in 2026.
The attack chain abuses the CMSTPLUA COM object to bypass User Account Control (UAC), granting elevated privileges without user interaction and running a hidden PowerShell process with administrative rights. Microsoft Defender exclusions are then configured to prevent interference, and both payloads are fetched and executed using different delivery methods.
## Attribution and Targeting
Neither campaign has been definitively linked to a named threat actor or group. However, technical indicators — including source code checks designed to prevent execution on systems with Russian keyboard layouts, Russian-language development artifacts, and the heavy targeting of Ukrainian websites and users — suggest a likely Russian-speaking origin.
Security analysts have noted that these campaigns represent a broader trend in the malware ecosystem: modular architectures that separate persistent access from data theft, enabling operators to swap out individual components and infrastructure while preserving core capabilities.
—
## Frequently Asked Questions (FAQ)
**Q: What is ClickFix?**
A: ClickFix is a social engineering technique where attackers trick website visitors into copying and pasting malicious commands into the Windows Run dialog. It relies on fake verification screens and deceptive instructions to manipulate users into executing malware silently.
**Q: Which browsers are affected by Psychedelic Stealer?**
A: Psychedelic Stealer targets all major Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex. It also scans for cryptocurrency wallets installed as browser extensions or desktop applications.
**Q: How can I protect myself from ClickFix attacks?**
A: Never paste commands into the Windows Run dialog from unsolicited website prompts. Always verify that verification screens are legitimate by checking the URL and browser tab. Keeping your operating system and antivirus software up to date also helps mitigate risks.
**Q: What makes RemotePanel different from traditional remote access tools?**
A: RemotePanel uses a blockchain-based smart contract on the BNB Smart Chain to resolve its command-and-control server. This allows attackers to change backend infrastructure dynamically without needing to rebuild or redeploy the malware on already-infected machines.
**Q: Why is Ukraine specifically targeted?**
A: Investigators noted that the campaign’s lure pages were written in Ukrainian, compromised Ukrainian business websites, and concentrated the vast majority of recorded interactions in Ukraine. These indicators strongly suggest the campaign was deliberately aimed at Ukrainian users, though the exact motive remains under investigation.
**Q: Is BoundSiphon capable of stealing data from Firefox?**
A: Yes. Unlike Psychedelic Stealer, which primarily targets Chromium-based browsers, BoundSiphon is designed to harvest credentials and sessions from both Chromium and Firefox browsers.
—
## Conclusion
The discovery of Psychedelic Stealer, RemotePanel, and BoundSiphon underscores the growing sophistication of cybercriminal operations that abuse trusted websites and social engineering to compromise unsuspecting users. The modular nature of these threats — separating access, persistence, and data theft into interchangeable components — makes them especially resilient and difficult to counter.
For businesses and individuals, vigilance is critical. Avoiding suspicious clipboard prompts, scrutinizing unexpected verification screens, and maintaining robust security tooling are essential steps in reducing exposure to these evolving threats. As cybercriminals continue to refine their tactics, the security community must remain equally adaptive in detecting, analyzing, and neutralizing new malware campaigns.
Thank you for reading
