Psychedelic Stealer ClickFix Campaign: Fake CAPTCHA MSI Installer Targets Ukrainian Enterprises — OTX Detection Pack

---
title: Psychedelic Stealer ClickFix MSI Execution via Windows Run Dialog
id: 7a3f9c2d-4b8e-4f1a-9d2c-5e6f8a9b0c1d
status: experimental
description: Detects msiexec.exe execution initiated from the Windows Run dialog, consistent with ClickFix social engineering delivering Psychedelic Stealer MSI payloads
author: Security Arsenal
references:
  - https://connect.securonix.com/threat-research-intelligence-62/the-psychedelic-stealer-when-the-captcha-is-the-installer-582
date: 2026/11/01
modified: 2026/11/01
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_img:
    - Image|endswith: '\msiexec.exe'
    - OriginalFileName: 'msiexec.exe'
  selection_cli:
    CommandLine|contains:
      - '/i http'
      - '/i https'
      - '/quiet'
      - '/qn'
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\mshta.exe'
  condition: selection_img and selection_cli and selection_parent
falsepositives:
  - Legitimate software deployment via MSI by system administrators
  - User-initiated installation of trusted software from vendor websites
level: high
---
title: Psychedelic Stealer Network Communication to Known C2 Infrastructure
id: 8b4f0d3e-5c9f-4e2b-8e3d-6f7a9b0c1d2e
status: experimental
description: Detects network connections to Psychedelic Stealer C2 infrastructure including direct IP communication on non-standard port 9000
author: Security Arsenal
references:
  - https://connect.securonix.com/threat-research-intelligence-62/the-psychedelic-stealer-when-the-captcha-is-the-installer-582
date: 2026/11/01
modified: 2026/11/01
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1573
logsource:
  category: network_connection
  product: windows
  service: sysmon
detection:
  selection_dest_ip:
    DestinationIp: '107.175.82.242'
  selection_dest_port:
    DestinationPort: 9000
  selection_dest_domain:
    DestinationHostname|contains:
      - 'uasputnik.com'
      - 'fsputnik.com'
  condition: selection_dest_ip or selection_dest_port or selection_dest_domain
falsepositives:
  - None expected for these specific IOCs in enterprise environments
level: critical
---
title: Psychedelic Stealer Browser Extension Native Messaging Persistence
id: 9c5e1f4a-6d0a-4f3c-9f4e-7a8b0c1d2e3f
status: experimental
description: Detects creation of browser native messaging host manifest files or registry keys associated with Psychedelic Stealer browser extension persistence
author: Security Arsenal
references:
  - https://connect.securonix.com/threat-research-intelligence-62/the-psychedelic-stealer-when-the-captcha-is-the-installer-582
date: 2026/11/01
modified: 2026/11/01
tags:
  - attack.persistence
  - attack.t1546
  - attack.t1176
logsource:
  category: registry_event
  product: windows
  service: sysmon
detection:
  selection_registry:
    TargetObject|contains:
      - '\Software\Google\Chrome\NativeMessagingHosts\'
      - '\Software\Mozilla\NativeMessagingHosts\'
      - '\Software\Microsoft\Edge\NativeMessagingHosts\'
  selection_details:
    Details|contains:
      - 'psychedelic'
      - 'psychedeliclove'
      - 'elita'
  condition: selection_registry and selection_details
falsepositives:
  - Legitimate browser extensions with native messaging components
level: high

// Hunt for Psychedelic Stealer execution and C2 communication
let PsychedelicHashes = dynamic([
    "06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90",
    "38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878",
    "1f250eb486571d99bc1e4d760e37a554",
    "ae5450f32bcb533c5b592c77a7861553"
]);
let PsychedelicDomains = dynamic(["uasputnik.com", "fsputnik.com"]);
let PsychedelicIPs = dynamic(["107.175.82.242"]);
let PsychedelicURLs = dynamic([
    "https://uasputnik.com/elita.msi",
    "http://107.175.82.242:9000/wilow/psychedeliclove.exe"
]);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "msiexec.exe"
| where ProcessCommandLine has_any ("/i http", "/i https", "elita.msi")
| extend IndicatorType = "MSI Execution", Indicator = ProcessCommandLine
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, IndicatorType, Indicator
),
(DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (PsychedelicIPs) or RemoteUrl has_any (PsychedelicDomains) or RemoteUrl in (PsychedelicURLs)
| extend IndicatorType = "Network C2", Indicator = strcat(RemoteIP, " | ", RemoteUrl)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl, IndicatorType, Indicator
),
(DeviceFileEvents
| where TimeGenerated > ago(30d)
| where SHA256 in (PsychedelicHashes) or MD5 in (PsychedelicHashes)
| extend IndicatorType = "File Hash", Indicator = SHA256
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, SHA256, IndicatorType, Indicator
),
(DeviceRegistryEvents
| where TimeGenerated > ago(30d)
| where RegistryKey has_any ("NativeMessagingHosts")
| where RegistryValueData has_any ("psychedelic", "psychedeliclove", "elita")
| extend IndicatorType = "Browser Extension Persistence", Indicator = RegistryKey
| project TimeGenerated, DeviceName, AccountName, RegistryKey, RegistryValueData, IndicatorType, Indicator
)
| order by TimeGenerated desc

# Psychedelic Stealer IOC Hunt Script
# Checks for execution artifacts, browser extension persistence, and network indicators

$ErrorActionPreference = 'SilentlyContinue'

Write-Host "=== Psychedelic Stealer IOC Hunt ===" -ForegroundColor Cyan
Write-Host "Checking for indicators on $env:COMPUTERNAME`n" -ForegroundColor Cyan

# Check for Psychedelic Stealer file hashes
$MaliciousHashes = @(
    "06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90",
    "38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878",
    "1f250eb486571d99bc1e4d760e37a554",
    "ae5450f32bcb533c5b592c77a7861553"
)

Write-Host "[+] Checking for Psychedelic Stealer file hashes..." -ForegroundColor Yellow
$SuspiciousPaths = @(
    "$env:TEMP",
    "$env:APPDATA",
    "$env:LOCALAPPDATA",
    "$env:USERPROFILE\Downloads",
    "$env:ProgramData"
)

foreach ($Path in $SuspiciousPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $SHA256 = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash
            $MD5 = (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash
            if ($MaliciousHashes -contains $SHA256 -or $MaliciousHashes -contains $MD5) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
                Write-Host "    SHA256: $SHA256" -ForegroundColor Red
                Write-Host "    MD5: $MD5" -ForegroundColor Red
            }
        }
    }
}

# Check for browser native messaging host persistence
Write-Host "`n[+] Checking browser native messaging host registry keys..." -ForegroundColor Yellow
$BrowserPaths = @(
    "HKCU:\Software\Google\Chrome\NativeMessagingHosts",
    "HKLM:\Software\Google\Chrome\NativeMessagingHosts",
    "HKCU:\Software\Mozilla\NativeMessagingHosts",
    "HKLM:\Software\Mozilla\NativeMessagingHosts",
    "HKCU:\Software\Microsoft\Edge\NativeMessagingHosts",
    "HKLM:\Software\Microsoft\Edge\NativeMessagingHosts"
)

foreach ($RegPath in $BrowserPaths) {
    if (Test-Path $RegPath) {
        Get-ChildItem -Path $RegPath | ForEach-Object {
            $KeyName = $_.PSChildName
            $ManifestPath = (Get-ItemProperty -Path $_.PSPath).'(default)'
            if ($KeyName -match "psychedelic|elita" -or $ManifestPath -match "psychedelic|elita") {
                Write-Host "[!] SUSPICIOUS NATIVE MESSAGING HOST: $KeyName" -ForegroundColor Red
                Write-Host "    Registry Path: $($_.PSPath)" -ForegroundColor Red
                Write-Host "    Manifest Path: $ManifestPath" -ForegroundColor Red
            }
        }
    }
}

# Check for network connections to C2 infrastructure
Write-Host "`n[+] Checking for active network connections to Psychedelic C2..." -ForegroundColor Yellow
$C2IPs = @("107.175.82.242")
$Connections = Get-NetTCPConnection | Where-Object { $C2IPs -contains $_.RemoteAddress }
if ($Connections) {
    $Connections | ForEach-Object {
        Write-Host "[!] ACTIVE C2 CONNECTION DETECTED" -ForegroundColor Red
        Write-Host "    Remote IP: $($_.RemoteAddress):$($_.RemotePort)" -ForegroundColor Red
        Write-Host "    State: $($_.State)" -ForegroundColor Red
        Write-Host "    Owning Process: $($_.OwningProcess)" -ForegroundColor Red
    }
} else {
    Write-Host "    No active connections to known C2 IPs detected." -ForegroundColor Green
}

# Check DNS cache for malicious domains
Write-Host "`n[+] Checking DNS cache for Psychedelic domains..." -ForegroundColor Yellow
$MaliciousDomains = @("uasputnik.com", "fsputnik.com")
$DNSCache = Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Entry }
if ($DNSCache) {
    $DNSCache | ForEach-Object {
        Write-Host "[!] MALICIOUS DOMAIN IN DNS CACHE: $($_.Entry)" -ForegroundColor Red
        Write-Host "    Data: $($_.Data)" -ForegroundColor Red
    }
} else {
    Write-Host "    No malicious domains found in DNS cache." -ForegroundColor Green
}

# Check for scheduled tasks and run key persistence
Write-Host "`n[+] Checking for persistence mechanisms..." -ForegroundColor Yellow
$RunKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)

foreach ($RunKey in $RunKeys) {
    if (Test-Path $RunKey) {
        Get-ItemProperty -Path $RunKey | ForEach-Object {
            $_.PSObject.Properties | Where-Object { $_.Name -notmatch "PS" } | ForEach-Object {
                if ($_.Value -match "psychedelic|elita|msiexec.*http") {
                    Write-Host "[!] SUSPICIOUS RUN KEY ENTRY: $($_.Name)" -ForegroundColor Red
                    Write-Host "    Value: $($_.Value)" -ForegroundColor Red
                }
            }
        }
    }
}

Write-Host "`n=== Hunt Complete ===" -ForegroundColor Cyan