Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their own machines with data-stealing malware.
According to the Computer Emergency Response Team of Ukraine (CERT-UA), the activity has been attributed to UAC-0145, a sub-cluster within Sandworm, an advanced hacking unit affiliated with GRU, Russia’s primary foreign military intelligence agency.
In these attacks, threat actors have been found to leverage fake CAPTCHA checks on compromised websites that instruct prospective targets to execute a PowerShell command in the terminal.
“The mentioned command, as an example, could be intended for downloading and saving a VBS file in the Startup autorun directory; one of the variants of such a program was called GHETTOVIBE,” CERT-UA said in an alert.
The attacks also involve the use of SCOUTCURL, a PowerShell script that performs basic reconnaissance by harvesting details about the infected machine. Some of the other malicious programs found in the infected endpoints are as follows –
- FLUIDLEECH and LOADLOOP, which act as loaders, with the former masquerading as software for removing computer viruses.
- FREAKYPOLL, a Python backdoor
At least 10 websites are assessed to have been compromised as part of this campaign between June and July 2026. Besides taking advantage of Cloaking.House, a traffic filtering service that makes it possible to serve different pages to different visitors, the attackers have been found to use a bespoke tool called SMARTAXE to dynamically alter the content of a web page depending on the site visitor and display a CAPTCHA check.
The CAPTCHA content to be injected into the web page employs the EtherHiding technique to retrieve the domain name of the remote resource from an Ethereum smart contract using an address specified in the source code.
CERT-UA said it also identified the threat actor using other attack techniques to break into devices, including backdooring Android devices by distributing APK files via messaging apps, by disguising them as security tools. The malware embedded in the APK file is a full-featured backdoor codenamed COWARDDUCK that can clandestinely collect the following details –
- Contacts
- Files matching certain extensions (“.conf,” “.json,” “.ovpn,” “.txt,” “.doc,” “.docx,” “.xls,” “.xlsx,” “.pptx,” “.zip,” and “.rar”) from the directories: “DCIM,” “Documents,” “Downloads,” “Pictures,” and “Alarms”
- Geolocation in real time
In tandem, the malware uses the Dropbox cloud service API to upload files, while retrieving commands or data from an external server or from legitimate sites like steamcommunity[.]com.
The use of ClickFix by the Kremlin-backed hacking crew marks a departure from prior campaigns that have made use of trojanized installers for Microsoft Windows or Office containing a built-in backdoor or through bogus antivirus software shared via the Signal messaging app.
The disclosure comes as ClickFix continues to be an effective social engineering technique for malware delivery across the cyber threat landscape, with bad actors leveraging it to distribute OXLOADER, Mistic, SCMBANKER, ClickLock Stealer, TELEPUZ, and ACR Stealer.
