The Psychedelic Stealer: When the CAPTCHA Is the Installer Between September 9 and September 14, 2026, an unattributed Russian-speaking operator compromised at least six legitimate Ukrainian small-business websites to deliver a fake Cloudflare verification page. The ClickFix chain convinced victims to manually execute msiexec.exe commands via the Windows Run dialog, achieving a 14 percent completion rate (79 infections from 426 clicks). The payload, internally named Psychedelic, combines credential theft with persistent agent capabilities, installing browser extensions with native-messaging bridges, establishing scheduled tasks, and polling a REST API for arbitrary executable tasking. Targeting focused overwhelmingly on Ukraine with clear financial motivation, collecting browser credentials, session tokens, and cryptocurrency wallet data from MetaMask, Trust Wallet, Exodus, Atomic Wallet, and others. The technique deliberately avoids encoded PowerShell, using signed Microsoft binaries to bypass common ClickFix detections. Pulse ID: 6abfb63a870eec5021127b09 Pulse Link: https://otx.alienvault.com/pulse/6abfb63a870eec5021127b09 Pulse Author: AlienVault Created: 2026-10-02 13:48:42 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #Psychedelic #CAPTCHA #Atomic #Clickfix #OTX #AlienVault