CTI · reviewed · 2026-09-27

Psychedelic Stealer spread via fake CAPTCHA prompts on Ukrainian company sites

Full story & timeline

Actors

—

Malware / tools

LunexPsychedelic Stealer

Campaigns

Lunex fake-CAPTCHA ClickFix campaign

CVEs

CVE-2023-20598

Victim sectors

—

Geography

Ukraine

MITRE ATT&CK

T1659 Content Injection Initial Access
T1204 User Execution Execution
T1059 Command and Scripting Interpreter Execution
T1548 Abuse Elevation Control Mechanism Privilege Escalation
T1014 Rootkit Stealth
T1053 Scheduled Task/Job Execution

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Fake CAPTCHA ClickFix Msiexec Download of Psychedelic Lunex Stealer
id: beb024e1-8f66-43ea-84a7-cdd5950d5257
status: experimental
description: Detects the msiexec command line pasted by victims after fake Cloudflare verification CAPTCHA prompts on compromised Ukrainian sites, fetching the Lunex/Psychedelic stealer MSI from uasputnik[.]com with its distinctive ORG_NOTE property.
references:
  - https://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.html
  - https://blueteam.cool/posts/clickfix-captcha-code-lol/
  - https://blueteam.cool/posts/lunex-c2-osint/
author: Tia N. List
date: 2026/09/27
tags:
  - attack.t1204
  - attack.t1059
  - attack.t1053
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_note:
    Image|endswith: '\msiexec.exe'
    CommandLine|contains: 'ORG_NOTE'
  selection_domain:
    Image|endswith: '\msiexec.exe'
    CommandLine|contains:
      - 'uasputnik'
      - 'fsputnik'
  condition: selection_note or selection_domain
falsepositives:
  - Uncommon but legitimate MSI installations passing an ORG_NOTE property
level: high

References

Source on GitHub