UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware

Russian state-sponsored threat actors from the UAC-0145 sub-cluster, linked to Sandworm and GRU, are using fake CAPTCHA checks on compromised websites to trick Ukrainian targets into executing PowerShell commands that install data-stealing malware. The campaign, reported by CERT-UA, involves the GHETTOVIBE VBS file, SCOUTCURL reconnaissance script, FLUIDLEECH and LOADLOOP loaders, and the FREAKYPOOL Python backdoor. At least 10 websites were compromised between June and July 2026. Attackers use Cloaking.House for traffic filtering and SMARTAXE to dynamically inject CAPTCHA content via the EtherHiding technique. Additionally, Android devices are targeted with COWARDDUCK backdoor disguised as security tools, exfiltrating contacts, files, and geolocation via Dropbox API. This marks a shift from previous trojanized installer campaigns.