The Psychedelic Stealer: When a CAPTCHA Becomes an Installer
Arctic Wolf Networks, Thursday, September 24th, 2026
Arctic Wolf Labs tracked a fake Cloudflare CAPTCHA campaign using a Ukrainian ClickFix lure to deliver Psychedelic Stealer malware in 32 countries.
Arctic Wolf Labs is tracking an ongoing campaign that compromises legitimate Ukrainian business websites and injects iframes displaying a fake Ukrainian-language Cloudflare verification page.
Visitors who interact with the ClickFix-style lure are tricked into running an installer that deploys Psychedelic Stealer, malware that steals browser passwords, account tokens, and cryptocurrency wallet data.
The campaign runs through a Russian-branded traffic distribution panel and has affected victims across 32 countries in Europe, the Americas, and Asia-Pacific.