Loading malware…
Psychedelic Stealer, also referred to as LunexStealer, is a 64-bit Windows information stealer associated with the Lunex malware-as-a-service platform. It has been distributed to predominantly Ukrainian-speaking users through compromised Ukrainian business websites that display ClickFix-style counterfeit Cloudflare/CAPTCHA verification pages. The lures instruct victims to paste and execute a copied Windows Installer command, which deploys a malicious MSI package and the stealer.
The malware collects saved passwords, account tokens, and session-related browser data from Chromium-based browsers including Chrome, Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi. It also targets browser-extension and desktop cryptocurrency wallets. Psychedelic Stealer profiles infected hosts, including system, hardware, browser, and installed security-product information, and uploads collected data to its command-and-control infrastructure.
Psychedelic Stealer establishes persistence using a scheduled task and browser native-messaging functionality. Its native messaging host can retain access after removal of the principal stealer executable and can enumerate drives and directories, read and write files, download additional content, and execute programs. The malware can also install a malicious browser extension and poll its command-and-control service for tasks, including execution of additional executable, script, installer, and command-shell payloads. Campaign reporting indicates a strong focus on Ukraine, but no threat actor attribution is established.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
“Psychedelic Stealer ... [is distributed] through compromised Ukrainian websites”
T1566 — Phishing (Initial Access).
“uses injected iframes to display a Ukrainian-language fake Cloudflare verification page. When a visitor interacts with the page, the lure …”
It creates a scheduled task for persistence named psychedelicloveUtils.
The implant's remote tasking capability supports execution of EXE, COM, BAT, CMD, MSI, and PowerShell files.
“It establishes persistent remote filesystem access via a PowerShell-based Native Messaging Host.”
The infection makes use of bogus MSI installers delivered via ClickFix.
The campaign uses a Ukrainian-language fake browser-verification page... Hunt for msiexec.exe process creation... The command executes via a Windows Run dialog (explorer.exe) opened by the user.
It creates a scheduled task for persistence named psychedelicloveUtils.
“It establishes persistent remote filesystem access via a PowerShell-based Native Messaging Host.”
T1547.005 — Boot or Logon Autostart Execution: Security Support Provider (Persistence).
It creates a scheduled task for persistence named psychedelicloveUtils.
T1547.005 — Boot or Logon Autostart Execution: Security Support Provider (Persistence).
T1027 — Obfuscated Files or Information (Defense Evasion).
“The attack chain begins with a fake CAPTCHA page”
“The infection utilizes bogus MSI installers”
There is no PowerShell involved... Instead, the command directly launches msiexec.exe. The downloaded MSI file then installs a 64-bit executable called psychedeliclove.exe.
The implant reads the Chromium Web Data database, creates a temporary copy named wd_tmp.db, and extracts records containing service, gaia_id, and token fields.
It also steals browser account tokens and targets cryptocurrency wallets.
“extracting credentials from seven Chromium-based browsers and cryptocurrency wallets”
Enumerate five desktop cryptocurrency wallets... and four browser extension wallets... and exfiltrate relevant data from them.
“The Psychedelic Stealer targets Ukrainian-speaking users, extracting credentials from seven Chromium-based browsers”
[The malware] collects cryptocurrency-wallet data... C2 paths include /api/v1/ext/wallets. Browser extension IDs identify MetaMask, Trust Wallet, OKX Wallet, and SafePal targets.
[The implant] profiles the host in detail including antivirus status and installed browsers.
[It collects] installed browsers... It specifically targets Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex.
[The implant] profiles the host in detail including antivirus status and installed browsers.
[The implant] then starts polling its command-and-control server for additional tasks... A later-stage sign is traffic to 193.178.159[.]128:8080, particularly requests to /api/v1/agent/ and /api/v1/ext/ with an X-API-Key header.
The downloaded MSI file then installs a 64-bit executable called psychedeliclove.exe... The implant... downloads attachments into downloads\<taskid>_<filename>, and supports EXE, COM, BAT, CMD, MSI, and PowerShell files.
T1041 — Exfiltration Over C2 Channel (Exfiltration).
34 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.