Full research report

UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware

Original reporting β†—
β˜… Threat intelligence assessment high confidence

Executive assessment

UAC-0145, a confirmed operational sub-cluster of the GRU-linked Sandworm group, has adopted ClickFix fake CAPTCHA pages as a primary initial-access vector against Ukrainian targets, marking a tactical evolution from trojanised Windows/Office installers and Signal-delivered malware observed in prior campaigns. The campaign's most technically significant element is SMARTAXE's use of EtherHiding β€” retrieving C2 domain names from Ethereum smart contracts via JSON-RPC β€” which renders the C2 infrastructure resistant to conventional domain takedown and requires network-level blocking of blockchain RPC endpoints rather than domain-based filtering. On Android, COWARDDUCK runs a parallel espionage track, targeting VPN configurations, geolocation, and documents and using Dropbox and Steam Community as C2 channels to evade network detection. With no CVEs involved and the entire chain relying on social engineering and user execution, the most effective defensive controls are behavioural: ASR rule enforcement, PowerShell restrictions for standard users, and MDM-enforced APK sideloading blocks. CERT-UA advisory #6318437 is the authoritative record, independently corroborated by The Record, The Cyber Express, and SOC Prime across at least four distinct outlets.

What happened

Between June and July 2026, UAC-0145 β€” a confirmed sub-cluster of the GRU-affiliated Sandworm group β€” compromised at least ten websites and weaponised them with fake CAPTCHA pages using the ClickFix social-engineering technique. Visitors identified as Ukrainian targets were prompted to run a PowerShell command that installed a multi-stage Windows malware chain including GHETTOVIBE (VBS persistence), SCOUTCURL (reconnaissance), FLUIDLEECH and LOADLOOP (loaders), and FREAKYPOLL (Python backdoor). In parallel, COWARDDUCK-laden APK files disguised as security tools were distributed via messaging apps to backdoor Android devices. CERT-UA published advisory #6318437 on approximately 16 July 2026 attributing the full campaign to UAC-0145.

Affected scope

Ukrainian government bodies, military personnel, and civilian users running Windows (primary ClickFix vector) or Android devices (COWARDDUCK); at least ten compromised third-party websites serving as infection points; no vendor products directly implicated and no CVE assigned.

Technical assessment

Two complementary infrastructure layers enabled selective targeting. Cloaking.House, a commercial traffic-filtering service, served malicious CAPTCHA content only to visitors matching the actor's targeting profile. SMARTAXE, a bespoke web-injection tool, retrieved C2 domain names from Ethereum smart contracts via JSON-RPC eth_call β€” the EtherHiding technique β€” making C2 infrastructure resistant to conventional domain takedown. On Windows, the ClickFix lure delivered GHETTOVIBE (VBS persistence in the Startup directory), SCOUTCURL (system and browser reconnaissance), FLUIDLEECH and LOADLOOP (loaders, the former masquerading as antivirus removal software), and FREAKYPOLL (Python backdoor); later-stage tools KALAMBUR, SUMBUR, and TAMBUR provided persistent access with OpenSSH and Tor tunnels targeting RDP and SMB (ports 3389, 445, 22) and data exfiltration via rsync. COWARDDUCK on Android collected contacts, documents, VPN configurations (.ovpn), and real-time geolocation, exfiltrating via the Dropbox API while receiving commands through steamcommunity.com to blend with legitimate traffic.

Recommended defensive actions

  1. Enforce Windows Attack Surface Reduction (ASR) rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria'; this control has been confirmed to stop the ClickFix/PowerShell chain before payload execution.
  2. Restrict PowerShell execution for standard users via AppLocker or Windows Defender Application Control; disable or constrain the Windows Run dialog to prevent clipboard-paste execution of malicious commands.
  3. Block outbound JSON-RPC calls to public Ethereum and BNB Chain RPC endpoints (drpc.org, bnbchain.org, Infura, Alchemy) from non-developer workstations at the proxy or firewall layer to neutralise the EtherHiding C2 retrieval step.
  4. Enforce MDM policies preventing APK sideloading on managed Android devices; treat APKs distributed via Signal, Telegram, or other messaging apps as high-risk and investigate any installation of 'security tool' APKs from unofficial sources.
  5. Hunt for Dropbox API and steamcommunity.com connections from endpoints where those services are not expected business use, as COWARDDUCK relies on these for exfiltration and command retrieval.

Uncertainties and evidence gaps

  • The precise range of Ukrainian organisations targeted beyond 'government and military personnel' has not been publicly confirmed.
  • Whether KALAMBUR, SUMBUR, and TAMBUR are new malware families unique to this campaign or rebranded tools from prior Sandworm operations has not been independently verified.
  • The full list of compromised websites has not been published; only the aggregate count (10+) is confirmed.
  • The degree to which the COWARDDUCK Android operation is coordinated with or operationally separate from the ClickFix Windows campaign is unclear from available reporting.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessNo authentication required; victim must visit a compromised website and be profiled by the traffic-filtering layer as a Ukrainian target, or receive a malicious APK via a messaging app.
ComponentBrowser session on compromised third-party websites (Windows); Windows clipboard and PowerShell/Run execution path; Android APK installation pathway via messaging apps.
MechanismFake CAPTCHA page instructs the user to copy and execute a PowerShell command from the clipboard; a parallel Android vector distributes backdoored APKs disguised as security utilities via messaging apps.
ImpactPersistent access, full system reconnaissance including browser data, credential and document theft, real-time geolocation tracking (Android), and lateral movement via encrypted tunnels to RDP and SMB services.
DetectionPowerShell child processes spawned from browser or clipboard workflows; outbound connections to Ethereum RPC endpoints or Dropbox API from unexpected hosts; RunMRU registry writes containing PowerShell or UNC paths; rundll32 executions referencing WebDAV with @80/@443 port syntax; Python .pyd modules appearing in AppData or Temp directories; APK installation from non-store sources on managed Android devices.
MitigationNo vendor patch applicable; attack chain relies on user execution. Primary mitigations: enforce ASR rules, restrict PowerShell for standard users, block blockchain RPC endpoints at the network perimeter, and enforce MDM APK-sideloading controls.
Exploitation status

Active social-engineering campaign confirmed by CERT-UA against Ukrainian targets June–July 2026; no CVE assigned; no public proof-of-concept code identified; exploitation relies entirely on user execution of ClickFix PowerShell lure or APK sideloading.

Research process

Investigation began with the THN article attributing the campaign to UAC-0145/Sandworm and citing CERT-UA as the authoritative source, without linking a specific advisory URL. A targeted search located the advisory at cert.gov.ua/article/6318437 and identified four independent outlets covering the story. Direct fetch of the CERT-UA page returned minimal content due to JavaScript rendering, so advisory details were cross-verified against The Record, The Cyber Express, and SOC Prime. A separate fetch of a technical EtherHiding write-up corroborated the blockchain-based C2 retrieval mechanism and yielded concrete detection signals, completing the assessment.

  1. Does the THN article contain verifiable claims and identify primary sources?
    Fetched the THN article directly.
    thehackernews.com β†—

    Confirmed attribution to UAC-0145/Sandworm, listed six malware families (GHETTOVIBE, SCOUTCURL, FLUIDLEECH, LOADLOOP, FREAKYPOLL, COWARDDUCK), described ClickFix and EtherHiding chain, cited CERT-UA as primary authority without a direct advisory link.

    why Established the full set of claims requiring corroboration and identified CERT-UA as the primary source to locate.

  2. What is the CERT-UA advisory reference and which independent outlets cover this campaign?
    Searched for 'UAC-0145 ClickFix CAPTCHA CERT-UA advisory 2026'.

    Located four independent outlets (The Cyber Express, SOC Prime, The Record, secnews.gr) and identified the CERT-UA advisory at cert.gov.ua/article/6318437.

    why Provided both the primary source URL and a map of independent corroborating outlets to visit.

  3. Does the CERT-UA advisory exist and what does it say?
    Fetched cert.gov.ua/article/6318437 directly.
    cert.gov.ua β†—

    Page loaded but returned only a 'CERT-UA' header; the advisory is likely JavaScript-rendered in Ukrainian and not accessible via static fetch. Existence confirmed; content must be drawn from secondary sources.

    why Primary source existence confirmed but content unreadable; elevated the importance of secondary source corroboration.

  4. What additional technical detail and malware families do independent outlets report?
    Fetched The Cyber Express article.
    thecyberexpress.com β†—

    Added post-access families KALAMBUR, SUMBUR, and TAMBUR; confirmed OpenSSH and Tor lateral movement on ports 445, 3389, and 22; confirmed rsync for exfiltration; described the five-stage attack chain.

    why Materially extended the malware inventory and infrastructure picture, improving scope and technical accuracy.

  5. Does The Record independently confirm attribution, targeting, and the advisory ID?
    Fetched The Record (Recorded Future) article.
    therecord.media β†—

    Independently confirmed Sandworm attribution, CERT-UA advisory #6318437, Ukrainian government and military targeting, and the ClickFix PowerShell chain; noted SCOUTCURL also harvests browser data.

    why Second independent domain confirming core facts, satisfying the corroboration requirement.

  6. Is the EtherHiding technique technically documented and what are its defensive signals?
    Fetched the Lindensec technical write-up on EtherHiding in ClickFix attacks.
    lindensec.com β†—

    Confirmed EtherHiding uses JSON-RPC eth_call to retrieve base64-encoded payloads from Ethereum/BNB Chain smart contracts; identified network detection signals (RPC endpoint connections from workstations) and endpoint signals (RunMRU registry writes, rundll32 WebDAV calls, Python .pyd files in temp directories); confirmed ASR rule effectiveness in stopping the chain.

    why Corroborated the blockchain C2 mechanism and provided sourced, concrete detection and mitigation actions for the defensive actions section.

Named in this story
ActorsUAC-0145SandwormAPT44GRU
MalwareGHETTOVIBESCOUTCURLFLUIDLEECHLOADLOOPFREAKYPOLLCOWARDDUCKSMARTAXEKALAMBURSUMBURTAMBUR
TargetsUkrainian government entitiesUkrainian military personnelUkrainian civilian users (Windows and Android devices)

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 60 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked β€” no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful β€” or not
The Hacker Newsnews ok3 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web ok10 records Checked β€” no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok1 records Checked β€” no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked β€” no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1647 records Checked β€” no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5307 records Checked β€” no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked β€” no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked β€” no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked β€” no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok257 records Checked β€” no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked β€” no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked β€” no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked β€” no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked β€” no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok661 records Checked β€” no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked β€” no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked β€” no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked β€” no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked β€” no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked β€” no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked β€” no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok3 records Checked β€” no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked β€” no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok16 records Checked β€” no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok3 records Checked β€” no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked β€” no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok18 records Checked β€” no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok17 records Checked β€” no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok4 records Checked β€” no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked β€” no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1583 records Checked β€” no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked β€” no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked β€” no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked β€” no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked β€” no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
Shodanresearch ok4 records Checked β€” no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked β€” no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked β€” no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked β€” no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked β€” no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked β€” no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked β€” no match The source completed, but none of its retained records matched this story.
Additional verified pages 7 opened outside the registered collection
References & evidence
PoC & exploit code1
Dissecting a Live ClickFix Attack: EtherHiding, WebDAV Abuse, and How ASR Saves the Day lindensec.com β†—

Technical write-up corroborating the EtherHiding blockchain C2 retrieval mechanism used by SMARTAXE; includes detection signals and ASR rule effectiveness.

Vendor & gov advisories1
Π’Π΅ΠΊΡ‚ΠΎΡ€ΠΈ ΠΏΠ΅Ρ€Π²ΠΈΠ½Π½ΠΎΡ— ΠΊΠΎΠΌΠΏΡ€ΠΎΠΌΠ΅Ρ‚Π°Ρ†Ρ–Ρ— UAC-0145 станом Π½Π° липСнь 2026 β€” CERT-UA #6318437 cert.gov.ua β†—

Primary CERT-UA advisory; page is JavaScript-rendered and returned minimal content on direct fetch, but advisory existence and ID confirmed by The Record, The Cyber Express, and SOC Prime.

Analysis & research4
Sandworm hackers have a CAPTCHA trick for Ukrainians β€” The Record therecord.media β†—

Independent Recorded Future coverage confirming Sandworm attribution, advisory ID 6318437, and Ukrainian government and military targeting.

ClickFix Attacks Fuel UAC-0145 Cyber Campaigns In Ukraine β€” The Cyber Express thecyberexpress.com β†—

Adds post-access families KALAMBUR, SUMBUR, TAMBUR and OpenSSH/Tor lateral movement detail not present in THN article.

UAC-0145 Uses Torrents, Signal, and ClickFix for Access β€” SOC Prime socprime.com β†—

Places advisory date at 16 July 2026; provides 21+ detection rules covering PowerShell, DNS, and network indicators.

UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices β€” The Hacker News thehackernews.com β†—

Primary reporting outlet; detailed malware inventory including COWARDDUCK Android backdoor and EtherHiding blockchain C2 technique.