Psychedelic Stealer: Fake CAPTCHA-Driven Infostealer Campaign Targeting Ukrainian Businesses — OTX Pulse Analysis & Enterprise Detection Pack

---
title: Psychedelic Stealer - Msiexec Remote MSI Execution via ClickFix Fake CAPTCHA
id: a1b2c3d4-psyc-0001-0001-000000000001
status: experimental
description: Detects msiexec.exe executing with a URL argument to install a remote MSI package, consistent with ClickFix fake CAPTCHA campaigns delivering Psychedelic stealer (T1218.007)
author: Security Arsenal Threat Intelligence
date: 2026/10/25
references:
  - https://arcticwolf.com/resources/blog/psychedelic-stealer-fake-clickfix-captcha-targets-ukraine/
  - https://otx.alienvault.com
tags:
  - attack.execution
  - attack.t1218.007
  - attack.t1204.001
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\msiexec.exe'
  selection_cmd:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  selection_protocol:
    CommandLine|contains:
      - '/i'
      - '/quiet'
      - '/qn'
  condition: selection_img and selection_cmd and selection_protocol
falsepositives:
  - Legitimate enterprise software deployment via MSI over HTTP (rare; SCCM typically uses SMB or HTTPS from internal servers)
level: high
---
title: Psychedelic Stealer - Clipboard Write Followed by Run Dialog Execution
id: a1b2c3d4-psyc-0002-0002-000000000002
status: experimental
description: Detects browser process writing to clipboard followed within 60 seconds by explorer.exe spawning msiexec, indicating ClickFix clipboard-hijack execution chain
tags:
  - attack.collection
  - attack.t1115
  - attack.execution
  - attack.t1204.001
  - attack.t1218.007
author: Security Arsenal Threat Intelligence
date: 2026/10/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_img:
    Image|endswith: '\msiexec.exe'
  selection_cmd_url:
    CommandLine|contains:
      - 'http'
      - '.msi'
  condition: selection_parent and selection_img and selection_cmd_url
falsepositives:
  - IT administrators running remote MSI installs via Run dialog
level: critical
---
title: Psychedelic Stealer - Browser Credential Store Access
id: a1b2c3d4-psyc-0003-0003-000000000003
status: experimental
description: Detects non-browser processes accessing Chrome, Edge, or Firefox credential and cookie stores, consistent with Psychedelic infostealer data collection (T1555.003)
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1555
author: Security Arsenal Threat Intelligence
date: 2026/10/25
logsource:
  category: file_event
  product: windows
detection:
  selection_chrome:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Login Data'
      - '\Google\Chrome\User Data\Default\Cookies'
      - '\Google\Chrome\User Data\Default\Web Data'
  selection_edge:
    TargetFilename|contains:
      - '\Microsoft\Edge\User Data\Default\Login Data'
      - '\Microsoft\Edge\User Data\Default\Cookies'
  selection_firefox:
    TargetFilename|contains:
      - '\Mozilla\Firefox\Profiles\'
      - 'logins.json'
      - 'cookies.sqlite'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\msmpeng.exe'
      - '\explorer.exe'
  condition: (selection_chrome or selection_edge or selection_firefox) and not filter_browsers
falsepositives:
  - Backup software accessing user profile directories
  - Enterprise DLP agents scanning browser data stores
level: high

// Psychedelic Stealer Hunt — Fake CAPTCHA ClickFix Campaign
// Hunt for msiexec remote URL execution + C2 beaconing to uasputnik.com
// Microsoft Sentinel / Defender for Endpoint Advanced Hunting
// Author: Security Arsenal Threat Intelligence | 2026-10-25

let Lookback = 30d;
let SuspiciousMSIHosts = dynamic(["uasputnik.com"]);

// Query 1: msiexec spawning with HTTP/S URL arguments (ClickFix execution)
let MsiexecRemote = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName =~ "msiexec.exe"
| where ProcessCommandLine has_any ("http://", "https://")
| where ProcessCommandLine has_any ("/i", "/qn", "/quiet")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, DeviceId
| extend DetectionType = "Msiexec_Remote_URL";

// Query 2: Network connections to known Psychedelic C2 / delivery infrastructure
let NetworkIOC = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl has_any (SuspiciousMSIHosts) or RemoteUrl contains "elita.msi" or RemoteUrl contains "sputnik.html"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, DeviceId
| extend DetectionType = "Network_IOCs_uasputnik";

// Query 3: Hash-based detection for known Psychedelic payloads
let HashIOC = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where SHA256 in (
    "06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90",
    "38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878"
  )
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, DeviceId
| extend DetectionType = "Hash_IOC_Psychedelic";

// Query 4: Non-browser processes accessing browser credential stores
let CredStoreAccess = DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where FolderPath has_any (
    "Chrome\\User Data\\Default\\Login Data",
    "Chrome\\User Data\\Default\\Cookies",
    "Edge\\User Data\\Default\\Login Data",
    "Edge\\User Data\\Default\\Cookies",
    "Firefox\\Profiles"
  )
| where not(InitiatingProcessFileName has_any ("chrome.exe", "msedge.exe", "firefox.exe", "MsMpEng.exe", "explorer.exe", "SearchIndexer.exe"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, DeviceId
| extend DetectionType = "Credential_Store_Access";

// Union all detection types
union MsiexecRemote, NetworkIOC, HashIOC, CredStoreAccess
| sort by TimeGenerated desc

# Psychedelic Stealer IOC & Artifact Hunt Script
# Security Arsenal Threat Intelligence | 2026-10-25
# Run on suspect endpoints or deploy via GPO/SCCM/Intune for fleet-wide sweep
# Requires: PowerShell 5.1+, local admin recommended

$ErrorActionPreference = 'SilentlyContinue'
$ReportPath = "$env:TEMP\Psychedelic_Hunt_Report_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
$Findings = @()

function Write-Finding($Category, $Detail) {
    $entry = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] [$Category] $Detail"
    $script:Findings += $entry
    Write-Host $entry -ForegroundColor Red
}

Write-Host "=== Psychedelic Stealer IOC Hunt ===" -ForegroundColor Cyan
Write-Host "Scanning host: $env:COMPUTERNAME`n" -ForegroundColor Cyan

# ── 1. Known SHA256 Hashes ──
$KnownHashes = @(
    '06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90',
    '38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878'
)

Write-Host "[1/6] Checking for known malicious file hashes..." -ForegroundColor Yellow
$SearchPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "$env:USERPROFILE\Downloads", "C:\Users\Public")
foreach ($path in $SearchPaths) {
    Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($KnownHashes -contains $hash) {
            Write-Finding "MALICIOUS_HASH" "File: $($_.FullName) | SHA256: $hash"
        }
    }
}

# ── 2. Suspicious MSI Artifacts ──
Write-Host "[2/6] Checking for suspicious MSI files and staging artifacts..." -ForegroundColor Yellow
$MSISuspectPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA\Temp", "C:\Users\Public\Downloads")
foreach ($path in $MSISuspectPaths) {
    Get-ChildItem -Path $path -Filter "*.msi" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
        if ($_.Name -match 'elita|sputnik|update|install|setup|checker|verify' -or $_.Length -lt 5MB) {
            Write-Finding "SUSPICIOUS_MSI" "MSI file: $($_.FullName) | Size: $($_.Length) bytes | Modified: $($_.LastWriteTime)"
        }
    }
}

# ── 3. Msiexec Run Dialog Artifacts (MUICache / UserAssist) ──
Write-Host "[3/6] Checking UserAssist and MUICache for msiexec execution artifacts..." -ForegroundColor Yellow
$UserAssistPaths = Get-ChildItem "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" -ErrorAction SilentlyContinue
foreach ($key in $UserAssistPaths) {
    $values = Get-ItemProperty "$($key.PSPath)\Count" -ErrorAction SilentlyContinue
    if ($values) {
        $values.PSObject.Properties | ForEach-Object {
            $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(($_.Name -replace '.', '=')))
            if ($decoded -match 'msiexec.*http') {
                Write-Finding "RUN_DIALOG_ARTIFACT" "UserAssist entry decoded: $decoded"
            }
        }
    }
}

# ── 4. Clipboard Hijack / Browser IOC Evidence ──
Write-Host "[4/6] Checking DNS cache for uasputnik.com resolution..." -ForegroundColor Yellow
$DNSCache = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match 'uasputnik' }
if ($DNSCache) {
    foreach ($entry in $DNSCache) {
        Write-Finding "DNS_IOC" "DNS cache entry: $($entry.Entry) -> $($entry.Data)"
    }
}

# ── 5. Network Connections to C2 ──
Write-Host "[5/6] Checking active network connections for uasputnik.com or suspicious outbound..." -ForegroundColor Yellow
$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($conn in $Connections) {
    $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
    if ($conn.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)' -and $proc.Name -notmatch '^(svchost|System|chrome|msedge|firefox|teams|outlook)') {
        Write-Finding "SUSPICIOUS_CONNECTION" "Process: $($proc.Name) (PID $($conn.OwningProcess)) -> $($conn.RemoteAddress):$($conn.RemotePort)"
    }
}

# ── 6. Scheduled Tasks / Persistence Check ──
Write-Host "[6/6] Checking for suspicious scheduled tasks and Run key persistence..." -ForegroundColor Yellow
$RunKeys = @(
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $RunKeys) {
    $values = Get-ItemProperty $key -ErrorAction SilentlyContinue
    if ($values) {
        $values.PSObject.Properties | Where-Object { $_.Value -match 'msiexec|elita|sputnik|http.*\.msi' } | ForEach-Object {
            Write-Finding "PERSISTENCE_RUNKEY" "$key\$($_.Name) = $($_.Value)"
        }
    }
}

$SuspiciousTasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.TaskName -match 'elita|sputnik|update|verify|checker' -and
    $_.Actions.Execute -match 'msiexec|powershell|cmd|wscript'
}
foreach ($task in $SuspiciousTasks) {
    Write-Finding "PERSISTENCE_SCHTASK" "Task: $($task.TaskName) | Action: $($task.Actions.Execute) $($task.Actions.Arguments)"
}

# ── Summary ──
Write-Host "`n=== Hunt Complete ===" -ForegroundColor Cyan
if ($Findings.Count -eq 0) {
    Write-Host "No indicators of Psychedelic Stealer compromise found on this host." -ForegroundColor Green
    $Findings += "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] CLEAN — No IOCs detected."
} else {
    Write-Host "$($Findings.Count) finding(s) detected. Review report at: $ReportPath" -ForegroundColor Red
    Write-Host "RECOMMENDED: Isolate host from network and escalate to IR team." -ForegroundColor Red
}

$Findings | Out-File -FilePath $ReportPath -Encoding UTF8
Write-Host "Report saved: $ReportPath" -ForegroundColor Cyan