Key Takeaways
- Russian state‑sponsored group UAC‑0145 (a Sandworm sub‑cluster) is using the ClickFix social‑engineering technique to trick Ukrainian users into running malicious PowerShell commands.
- Fake CAPTCHA prompts on compromised sites deliver a VBS payload (GHETTOVIBE) that achieves persistence via the Startup autorun folder.
- The campaign also deploys reconnaissance (SCOUTCURL), loaders (FLUIDLEECH, LOADLOOP), a Python backdoor (FREAKYPOLL), and an Android backdoor (COWARDDUCK) that steals contacts, files, geolocation, and uploads data to Dropbox.
- Attackers employ Cloaking.House for traffic filtering, the custom tool SMARTAXE for dynamic page alteration, and EtherHiding (Ethereum smart‑contract lookup) to obtain CAPTCHA‑injection domains.
- At least ten websites were compromised between June and July 2026, illustrating a shift from trojanized installers/fake AV to ClickFix‑based delivery.
- ClickFix remains a prevalent malware‑distribution method, also seen in campaigns delivering OXLOADER, Mistic, SCMBANKER, ClickLock Stealer, TELEPUZ, and ACR Stealer.
Overview of the ClickFix‑Based Campaign
In July 2026, Ukraine’s Computer Emergency Response Team (CERT‑UA) disclosed a sustained cyber‑espionage operation targeting Ukrainian individuals and organizations. The activity has been attributed to UAC‑0145, a sub‑cluster within the notorious Sandworm hacking unit that operates under Russia’s GRU (Main Intelligence Directorate). Rather than relying on traditional trojanized software installers or bogus antivirus apps distributed via Signal, the threat actors have revived the ClickFix social‑engineering lures. ClickFix convinces victims that they must complete a seemingly benign verification step—often a CAPTCHA—before they can proceed, thereby coaxing them into executing attacker‑controlled commands on their own machines.
Mechanics of the Fake CAPTCHA Lure
The core of the campaign revolves around compromised websites that present a counterfeit CAPTCHA challenge. When a visitor encounters the prompt, the page instructs them to open a Windows terminal and paste a specific PowerShell command. One example cited by CERT‑UA is a command designed to download and store a VBS script named GHETTOVIBE in the user’s Startup autorun directory, ensuring the malware runs each time the system boots. The use of a PowerShell one‑liner reduces the barrier for execution, as many users are accustomed to copying and pasting snippets for troubleshooting or system tweaks.
Persistence and Initial Payload: GHETTOVIBE
GHETTOVIBE functions as a lightweight downloader that, once placed in the autorun folder, contacts a remote server to retrieve additional stages of the infection chain. Its placement in the Startup folder is a classic persistence mechanism, bypassing the need for elevated privileges while still guaranteeing execution on user logon. By leveraging a legitimate Windows feature, the malware avoids many heuristic detections that flag unfamiliar executable locations.
Reconnaissance Component: SCOUTCURL
After establishing foothold, the attackers deploy SCOUTCURL, a PowerShell script tasked with gathering basic system intelligence. SCOUTCURL harvests data such as the operating system version, hostname, username, installed security products, network configuration, and running processes. This information helps the threat actors tailor subsequent payloads, decide whether to escalate privileges, and avoid environments that might hinder their operation (e.g., heavily monitored corporate networks).
Loader Malware: FLUIDLEECH and LOADLOOP
The infection chain includes two loader families: FLUIDLEECH and LOADLOOP. Both are designed to fetch and execute further malicious modules from command‑and‑control (C2) servers. Notably, FLUIDLEECH masquerades as a utility for removing computer viruses, exploiting users’ trust in security‑related software to evade suspicion. LOADLOOP, while less conspicuous, serves a similar purpose and may be used to distribute payloads that are less likely to trigger antivirus alerts due to its benign‑looking file names and signatures.
Python Backdoor: FREAKYPOLL
In addition to PowerShell‑based tools, the campaign drops FREAKYPOLL, a Python‑written backdoor. FREAKYPOLL opens a reverse shell to an attacker‑controlled server, enabling arbitrary command execution, file upload/download, and lateral movement within the compromised host. Its use of Python allows the actors to blend in with legitimate scripting activity, especially in environments where Python is commonly employed for administration or automation.
Android Targeting: COWARDDUCK
Recognizing the prevalence of mobile devices among Ukrainian users, the threat actors extended their reach to Android platforms. They distribute malicious APK files via popular messaging apps, disguising them as security tools or utility applications. Once installed, the APK executes COWARDDUCK, a full‑featured backdoor that harvests a broad range of personal data:
- Contacts list
- Files with extensions such as .conf, .json, .ovpn, .txt, .doc, .docx, .xls, .xlsx, .pptx, .zip, and .rar from directories including DCIM, Documents, Downloads, Pictures, and Alarms
- Real‑time geolocation coordinates
The stolen data is exfiltrated using the Dropbox cloud‑storage API, which provides a reliable and often overlooked channel for data theft. COWARDDUCK also periodically contacts legitimate sites like steamcommunity[.]com to retrieve commands or additional payloads, thereby blending malicious traffic with benign‑looking requests to popular‑service traffic.
Infrastructure and Evasion Tactics
To maximize the effectiveness of the ClickFix lure, the attackers employ several sophisticated evasion and targeting mechanisms:
-
Cloaking.House – A traffic‑filtering service that serves different content to visitors based on attributes such as IP address, user‑agent, or geographic location. This allows the threat actors to show the fake CAPTCHA only to intended Ukrainian targets while presenting benign content to security researchers or unrelated users.
-
SMARTAXE – A bespoke tool developed by the group to dynamically alter web‑page content in real time. SMARTAXE injects the CAPTCHA element and the associated PowerShell instruction after evaluating visitor characteristics, ensuring the lure appears contextually appropriate.
- EtherHiding – The domain used for the CAPTCHA‑injection resource is not hard‑coded but retrieved on the fly from an Ethereum smart contract. By encoding the domain within a blockchain transaction and referencing a specific contract address in the source code, the attackers obtain a resilient, decentralized method of updating the C2 infrastructure without exposing static domains that could be blocked or sinkholed.
These layers combine to make detection and takedown considerably more challenging for defenders, as the malicious infrastructure can shift rapidly while maintaining a low profile on conventional threat‑intelligence feeds.
Broader Context: ClickFix as a Persistent Threat Vector
CERT‑UA’s alert notes that the ClickFix technique continues to be a favored method for malware distribution across the cyber‑threat landscape. Recent campaigns have leveraged ClickFix to deliver families such as OXLOADER, Mistic, SCMBANKER, ClickLock Stealer, TELEPUZ, and ACR Stealer. The technique’s success hinges on exploiting human psychology—users’ willingness to comply with seemingly legitimate verification steps—rather than relying solely on technical vulnerabilities. Consequently, even well‑patched systems remain vulnerable when users are tricked into executing attacker‑supplied commands.
Implications for Ukrainian Entities and Defensive Recommendations
The observed activities underscore the need for a multi‑layered defense strategy that addresses both technical and human factors:
- User Awareness Training: Educate employees and the public about the dangers of executing unfamiliar PowerShell or command‑line instructions, especially when prompted by unsolicited CAPTCHA or verification dialogs.
- Endpoint Monitoring: Deploy behavior‑based detection that flags atypical PowerShell usage, unauthorized modifications to the Startup folder, and unexpected outbound connections to services like Dropbox or blockchain nodes.
- Web‑Application Security: Regularly scan and patch web‑sites to prevent compromise; implement Content Security Policy (CSP) headers to restrict inline script execution; and consider blocking known malicious services such as Cloaking.House and SMARTAXE‑associated domains.
- Network Controls: Restrict outbound traffic to known legitimate APIs (e.g., Dropbox) unless explicitly required, and enforce TLS inspection to detect abuse of legitimate services for C2.
- Mobile Device Management (MDM): Enforce app‑installation policies that prohibit sideloading of APKs from unofficial sources and scrutinize apps requesting excessive permissions (contacts, storage, location).
- Threat Intelligence Sharing: Participate in information‑sharing platforms (e.g., MISP, OTX) to receive indicators related to Ethereum‑based domain retrieval, known C2 IP ranges, and file hashes associated with GHETTOVIBE, SCOUTCURL, FLUIDLEECH, LOADLOOP, FREAKYPOLL, and COWARDDUCK.
Conclusion
The ClickFix‑driven operation attributed to UAC‑0145 illustrates how Russian state‑sponsored actors adapt their tradecraft to bypass conventional defenses by exploiting user trust and leveraging decentralized infrastructure for resilience. By combining social engineering, PowerShell‑based payloads, Android malware, and clever obfuscation techniques (Cloaking.House, SMARTAXE, EtherHiding), the campaign achieves broad data collection from both desktop and mobile victims in Ukraine. Defenders must therefore prioritize user education, robust endpoint and network monitoring, and proactive web‑security measures to mitigate the persistence and impact of such sophisticated, socially engineered threats.