Ukrainian Sites Injected with ClickFix Iframes Deliver Psychedelic Stealer via msiexec MSI Chains

The campaign targets at least six Ukrainian commercial and service sites, inserting an iframe that loads tracker.js and renders a Ukrainian-language Cloudflare verification page. Interaction copies an msiexec /i command to the clipboard; after a timed 38-second delay the page instructs the user to paste and run it. The MSI retrieves psychedeliclove.exe from 107.175.82[.]242:9000, which then harvests Chromium credentials, wallet extensions, and tokens before establishing scheduled-task persistence and a native-messaging bridge. Arctic Wolf observed six distinct MSI filenames and an exposed Rublevka TDS panel on the same infrastructure registered 9 September 2026. The stealer polls /api/v1/agent/tasks for further payloads and can execute EXE, MSI, and PowerShell commands. No CVE or public exploit is involved; infection relies entirely on social engineering of the ClickFix sequence. The pattern matches prior ClickFix operations that compromised regional news and e-commerce sites in 2025, yet this instance shows tighter integration between the TDS panel, browser-extension deployment, and recurring C2 tasking. Ukrainian targets suggest either opportunistic hosting abuse or deliberate selection for local-language lures, not state attribution without infrastructure overlap evidence. Operators are likely to rotate domains and MSI names within weeks while retaining the Rublevka panel for task distribution. Defenders should monitor for new uasputnik[.]com subdomains and block the listed IPs and the fsputnik tracker script.