UAC-0145 Uses ClickFix CAPTCHAs to Deploy Malware in Ukraine

The Computer Emergency Response Team of Ukraine (CERT-UA) has attributed a wave of ClickFix social-engineering attacks against Ukrainian government and military targets to UAC-0145, a sub-cluster of Sandworm, the advanced persistent threat unit operating under Russia’s GRU military intelligence directorate.

The campaigns ran across more than ten compromised websites during June and July 2026 and delivered a multi-stage malware chain including a VBS persistence implant, a PowerShell reconnaissance script, a loader disguised as antivirus removal software, and an Android backdoor distributed via messaging applications.

How ClickFix Works Here

ClickFix is a social-engineering technique that replaces conventional malware delivery — phishing attachments, drive-by exploits — with instructions that cause the victim to execute the payload themselves. In UAC-0145’s implementation, visitors to compromised websites were served a fake CAPTCHA prompt. The page instructed them to copy a PowerShell command and paste it into Windows Run or Windows Terminal to “verify” they were human.

Executing the command fetched and staged the initial malware. Because the victim’s own user session runs the command, perimeter controls that would otherwise block network-delivered executables offer little resistance. The technique has been observed across multiple threat actor groups over the past year and continues to spread because it sidesteps standard endpoint detection triggers associated with direct file drops. The SVR-linked hotel Wi-Fi campaign Microsoft tracks as CaptiveCrunch runs the same lure from a hijacked captive portal instead of a compromised website.

Traffic Filtering and Blockchain-Based Infrastructure

UAC-0145 used the Cloaking.House traffic filtering service to ensure the malicious CAPTCHA was only served to targets matching the intended profile. Visitors outside the target criteria received benign content, complicating bulk detection and crawling by security researchers.

The group also deployed a bespoke tool called SMARTAXE, which dynamically modifies webpage content and retrieves attacker-controlled domains via Ethereum smart contracts — a technique known as EtherHiding. Storing C2 infrastructure references on a public blockchain makes domain takedowns significantly harder: blocking a domain does not eliminate the pointer encoded on-chain. It is the same resilience problem law enforcement ran into when Dutch investigators seized 800 servers from the hosting network that had absorbed Stark Industries Solutions, where the infrastructure reconstituted under new legal entities within weeks — the pattern traced across the whole enforcement record in bulletproof hosting: why takedowns keep failing. File exfiltration from compromised Windows hosts routed through the Dropbox API, another pattern designed to blend outbound traffic with legitimate cloud service usage.

Malware Components

CERT-UA’s analysis (alert #6318437) identified six distinct malware families across the Windows and Android surfaces:

GHETTOVIBE — A VBS file written to startup autorun directories, providing persistence across reboots.

SCOUTCURL — A PowerShell reconnaissance script. It harvests machine details, installed software inventory, file listings, and browser data, then stages that information for exfiltration.

FLUIDLEECH — A loader that masquerades as antivirus removal software, likely chosen to exploit user trust in security tooling and lower the chance a target will question why they are running it.

LOADLOOP — A secondary loader component used to stage further payloads.

FREAKYPOLL — A Python backdoor providing command execution on infected Windows hosts.

COWARDDUCK — A full-featured Android backdoor delivered via APK files through messaging applications. COWARDDUCK harvests contacts, geolocation, and specific file types including configuration files (.conf, .ovpn), Office documents, spreadsheets, and compressed archives. Command retrieval for the Android implant was routed through steamcommunity[.]com, using a legitimate gaming platform as a covert channel to avoid network-based blocking.

The use of APK-distributed Android malware disguised as security tools mirrors a broader trend in state-sponsored campaigns targeting mobile devices held by military and government personnel, where operational security files (.ovpn VPN configs, .conf files) carry high intelligence value.

Targets and Campaign Scope

CERT-UA identified Ukrainian government networks and military personnel as the primary targets. The Record’s reporting noted that Sandworm has previously used footholds established through initial access campaigns to pre-position for destructive attacks against Ukraine’s central executive authorities. The ClickFix operation fits that pattern: initial compromise via social engineering, followed by staged reconnaissance and persistent access tools that can be leveraged for follow-on action.

The campaign ran in parallel with separate UAC-0145 tactics including backdoored Windows and Office installers distributed via torrents, and fake antivirus software targeting Signal users — indicating an active, multi-vector access operation rather than a single isolated campaign.

What Defenders Should Do

1. Block or alert on interactive PowerShell execution from Run dialog prompts. Windows Defender Attack Surface Reduction rule Block execution of potentially obfuscated scripts and Block all Office applications from creating child processes do not cover the Run dialog path; deploy Script Block Logging (Event ID 4104) and alert on encoded or downloaded PowerShell commands.

2. Restrict outbound Dropbox API traffic at the perimeter. api.dropboxapi.com and content.dropboxapi.com should require explicit business justification; block or proxy and inspect for non-sanctioned use.

3. Monitor for Ethereum RPC calls from non-developer endpoints. EtherHiding-based C2 retrieval requires outbound connections to public Ethereum nodes; flag eth_call requests from workstations.

4. Audit Android device management for sideloaded APKs. Enforce MDM policy preventing installation from unknown sources on any device with access to government or military network credentials or VPN configuration files.

5. Hunt for VBS files in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup and per-user startup locations. GHETTOVIBE’s persistence mechanism is a known autorun directory; a scheduled EDR query covering those paths will surface both this and similar implants.

CERT-UA has made indicator sets available through its portal. Organizations supporting Ukrainian government or defense supply chains should request access and apply network and endpoint detections within 48 hours given the active campaign window.