Recent analyses by **Arctic Wolf Labs** and **Blackpoint Cyber** reveal two distinct, yet equally concerning, **ClickFix** campaigns. These campaigns are employing novel malware to achieve persistent access and exfiltrate sensitive data, primarily targeting users through compromised legitimate websites. ## Psychedelic Stealer Targets Ukrainian Users **Arctic Wolf Labs** has detailed an active **ClickFix** operation compromising legitimate Ukrainian business websites. The attackers inject bogus **Cloudflare** verification pages designed to trick visitors into downloading a previously undocumented information stealer named **Psychedelic**.  The attack chain begins when a visitor interacts with the fake verification page. This action copies a Windows Installer command to the clipboard, instructing the user to paste it into the Windows Run dialog. The **ClickFix** chain then utilizes an `msiexec.exe` command to fetch a Windows MSI installer, which delivers the **Psychedelic Stealer**. This malicious tool is designed to harvest browser passwords, account tokens, and cryptocurrency wallet data. It also establishes scheduled-task persistence and communicates with a command-and-control (C2) server for further instructions. Compromised websites include a diverse range of businesses such as a hair-treatment clinic, a scale-model manufacturer, and a psychological facility. These sites feature an injected iframe element that executes attacker-controlled JavaScript from `fsputnik[.]com/tds/tracker[.]js`.  The **Psychedelic Stealer** is a 64-bit Windows executable capable of: * Collecting credentials from **Chromium**-based browsers (**Google Chrome**, **Microsoft Edge**, **Brave**, **Opera**, **Vivaldi**, **Yandex**). * Collecting browser-associated account tokens. * Scanning for and exfiltrating data from known cryptocurrency wallet browser extensions (**MetaMask**, **Trust Wallet**, **OKX Wallet**, **SafePal**) and desktop apps (**Exodus**, **Atomic Wallet**, **Electrum**, **Bitcoin Core**, **Litecoin Core**). * Capturing extensive host information. * Terminating browser processes, extracting an embedded extension archive into browser profiles, and setting up a native-messaging bridge for persistent data collection and communication with a local host component. The stealer can also retrieve further tasks from its C2 server, enabling the operators to deploy additional malware, including EXE, COM, BAT, CMD, MSI, and PowerShell payloads. **Arctic Wolf** identified an exposed lure management panel, **РУБЛЁВКА TDS (Rublevka TDS)**, linked to the campaign. This panel, distinct from the implant's C2, is used to configure web-lure commands and track interactions. Analysis of the panel data showed 557 views, 426 clicks, and 79 complete events across 32 countries, with Ukraine accounting for the vast majority of activity. Russian-language branding and implementation artifacts suggest likely Russian operators. ## RemotePanel and BoundSiphon: A Dual Payload Threat Separately, **Blackpoint Cyber** has uncovered another **ClickFix** chain delivering two previously undocumented .NET malware components: **RemotePanel** and **BoundSiphon**. **RemotePanel** is a persistent remote access platform that masquerades as the Windows Time service. It grants operators extensive control over infected systems, including **PowerShell** access, file and process management, screen access, and modular hidden virtual network computing (**hVNC**). **BoundSiphon** is a .NET credential and cryptocurrency stealer that targets both **Chromium** and **Firefox** browsers. It runs primarily from memory, focusing on browser credentials and sessions, cryptocurrency wallets, password manager data, and selected documents, including those protected by **Chromium App-Bound Encryption**. **RemotePanel** uses a **BNB Smart Chain** contract to resolve its C2 server, allowing threat actors to rotate infrastructure without redeploying the malware. **BoundSiphon** shares overlaps with a stealer previously distributed via malicious **NuGet** packages. The attack sequence involves a **ClickFix** command that uses **PowerShell** to initiate a multi-stage chain. An intermediate component abuses the **CMSTPLUA** COM object to bypass **User Account Control (UAC)** and gain elevated administrative privileges. This privileged **PowerShell** process then configures broad **Microsoft Defender** exclusions and fetches the **RemotePanel** and **BoundSiphon** payloads. **RemotePanel** is written to disk and installed as a service for persistent remote access, while **BoundSiphon** is loaded directly into memory through **PowerShell** for immediate data collection. Although no specific threat actor group has been attributed, artifacts such as source code checks to avoid execution on systems with a Russian keyboard layout suggest a possible Russian-speaking development environment.