The Hacker News17%
UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware 42%
By Ravie Lakshmanan12%
7/19/2026, 6:30:00 AM
Keywords: Malware, Cyber Warfare, Android, Windows, Clickfix, Uac 0145, Sandworm, Powershell, Captcha, Social Engineering
BS Summary: This article contains 17 faulty reasoning types, including Hasty Generalization, Representativeness Heuristic, and Negativity Bias, with Appeal to Authority as the most egregious example at 18.6% saturation with 91 hits. Analysis detected 728 faulty-reasoning hits from 489 analyzed words, generating a BS Score of 46.1% and a BS Rank of 42% (12,766 of 21,887 articles). This article is better (less manipulative) than 58.30% of the article peer group.
Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their own machines with data-stealing malware.
According to the Computer Emergency Response Team of Ukraine (CERT-UA), the activity has been attributed to UAC-0145, a sub-cluster within Sandworm, an advanced hacking unit affiliated with GRU, Russia's primary foreign military intelligence agency.
In these attacks, threat actors have been found to leverage fake CAPTCHA checks on compromised websites that instruct prospective targets to execute a PowerShell command in the terminal.
"The mentioned command, as an example, could be intended for downloading and saving a VBS file in the Startup autorun directory; one of the variants of such a program was called GHETTOVIBE," CERT-UA said in an alert.
The attacks also involve the use of SCOUTCURL, a PowerShell script that performs basic reconnaissance by harvesting details about the infected machine.
Some of the other malicious programs found in the infected endpoints are as follows -
FLUIDLEECH and LOADLOOP, which act as loaders, with the former masquerading as software for removing computer viruses.
FREAKYPOLL, a Python backdoor
At least 10 websites are assessed to have been compromised as part of this campaign between June and July 2026.
Besides taking advantage of Cloaking.House, a traffic filtering service that makes it possible to serve different pages to different visitors, the attackers have been found to use a bespoke tool called SMARTAXE to dynamically alter the content of a web page depending on the site visitor and display a CAPTCHA check.
The CAPTCHA content to be injected into the web page employs the EtherHiding technique to retrieve the domain name of the remote resource from an Ethereum smart contract using an address specified in the source code.
CERT-UA said it also identified the threat actor using other attack techniques to break into devices, including backdooring Android devices by distributing APK files via messaging apps, by disguising them as security tools.
The malware embedded in the APK file is a full-featured backdoor codenamed COWARDDUCK that can clandestinely collect the following details -
Contacts
Files matching certain extensions (".conf," ".json," ".ovpn," ".txt," ".doc," ".docx," ".xls," ".xlsx," ".pptx," ".zip," and ".rar") from the directories: "DCIM," "Documents," "Downloads," "Pictures," and "Alarms"
Geolocation in real time
In tandem, the malware uses the Dropbox cloud service API to upload files, while retrieving commands or data from an external server or from legitimate sites like steamcommunity[.]com.
The use of ClickFix by the Kremlin-backed hacking crew marks a departure from prior campaigns that have made use of trojanized installers for Microsoft Windows or Office containing a built-in backdoor or through bogus antivirus software shared via the Signal messaging app.
The disclosure comes as ClickFix continues to be an effective social engineering technique for malware delivery across the cyber threat landscape, with bad actors leveraging it to distribute OXLOADER, Mistic, SCMBANKER, ClickLock Stealer, TELEPUZ, and ACR Stealer.
Speakers
1speaker21%attributed speech385writer words
Voice mapSelect a segment to jump to its words
Selected voice
100%flagged-word coverageComputer Emergency Response Team of Ukraine (CERT-UA)
104 attributed words100% of attributed speech78% writer coverage
Attribution is sentence-level. Pattern percentages are calculated only from words assigned to that voice.
Loading…
Loading…
Loading…
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.