UAC-0145 Uses Click Fix CAPTCHAs to Infect Ukrainian Devices wih Malware
Summary: CERT-UA attributed a ClickFix campaign to UAC-0145, a sub-cluster within Sandworm, the GRU-affiliated unit, in which compromised websites show fake CAPTCHA checks that instruct targets to run a PowerShell command in the terminal. CERT-UA said the command could download and save a VBS file such as GHETTOVIBE to the Startup autorun directory, and at least 10 websites are assessed to have been compromised between June and July 2026, with the attackers using Cloaking.House, a bespoke tool called SMARTAXE, and the EtherHiding technique to pull a domain from an Ethereum smart contract.
What's compelling: The intrusion starts with a person typing a command into their own terminal, so the malware arrives through a trusted user action rather than an exploit, and the same actor also distributes APK files disguised as security tools through messaging apps to backdoor Android devices with COWARDDUCK.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026