UAC-0145 Uses ClickFix CAPTCHAs to Deploy Malware in Ukraine

Russian state-sponsored threat actor UAC-0145, a sub-cluster within the GRU-linked Sandworm advanced hacking unit, has been observed weaponizing the ClickFix social engineering strategy to compromise Ukrainian targets. According to CERT-UA, the campaign leverages fake CAPTCHA checks injected into at least 10 compromised websites between June and July, instructing victims to execute a malicious PowerShell command in their terminal. Once run, the command downloads and saves a VBS file named GHETTOVIBE into the Windows Startup autorun directory, ensuring persistence on the infected machine. Researchers analyzing the campaign infrastructure have pointed to cloaking services that selectively serve malicious payloads, a tactic defenders can investigate further using a VPN/proxy detector to identify traffic-filtering intermediaries on suspicious domains.

The attack chain deploys multiple malware families tailored for reconnaissance and payload delivery. SCOUTCURL, a lightweight PowerShell script, performs initial system enumeration, harvesting machine details before handing off to loaders FLUIDLEECH and LOADLOOP. FLUIDLEECH notably masquerades as legitimate antivirus software to lower victim suspicion, while FREAKYPOLL, a Python-based backdoor, provides the operators with sustained remote access. To obfuscate their infrastructure, the threat actors used Cloaking.House, a traffic filtering service, alongside a bespoke tool dubbed SMARTAXE that dynamically alters webpage content based on visitor attributes and serves the fraudulent CAPTCHA. The CAPTCHA payload itself employs the EtherHiding technique, retrieving its command-and-control domain from an Ethereum smart contract address hardcoded in the source code, making takedowns significantly harder. The use of blockchain-based hosting for malware C2 is a growing trend; security teams can use a DNS leak test to audit whether their own DNS queries are exposing infrastructure details.

In parallel with the Windows-focused ClickFix operations, UAC-0145 has been distributing malicious Android APK files via messaging apps, disguising them as security tools. The embedded payload, a full-featured backdoor named COWARDDUCK, silently exfiltrates contacts, files with sensitive extensions (.conf, .json, .ovpn, .doc, .xlsx, .zip, among others) from directories including DCIM, Documents, Downloads, and Pictures, and tracks real-time geolocation. Stolen data is uploaded via the Dropbox cloud API, while command retrieval leverages legitimate services such as steamcommunity[.]com to blend malicious traffic with benign activity. This marks a departure from Sandworm's prior tradecraft, which relied on trojanized Windows and Office installers or fake antivirus software shared through Signal. Organizations should verify the legitimacy of any site serving unexpected CAPTCHA prompts and run a SSL/TLS checker on linked resources to detect certificate anomalies before executing any instructions.