-
CERT-UA says Russian hacking group UAC-0145 now uses fake CAPTCHA pages to trick people into infecting their own Windows computers.
-
The campaign spreads several malware families that steal data, keep long-term access, and even target Android phones.
-
Researchers say the operation shows how ClickFix attacks are becoming a favorite method for both cybercriminals and state-backed hacking groups.
Russian state-backed hackers have changed the way they spread malware. Instead of breaking into computers through software flaws, they now trick people into infecting their own devices.
The Computer Emergency Response Team of Ukraine (CERT-UA) said the activity comes from UAC-0145. The group is linked to Sandworm, a hacking unit connected to Russia’s military intelligence agency, the GRU.
According to CERT-UA, the attackers place fake CAPTCHA pages on hacked websites. These pages look normal at first. They ask visitors to prove they are human before continuing. The trick comes next.
The fake page tells users to copy and run a PowerShell command in the Windows terminal. Once the command runs, it downloads malware onto the computer. The malware also makes sure it stays active after the system restarts.
This attack does not depend on finding a weakness in Windows. Instead, it depends on convincing people to follow fake instructions. According to CERT-UA, one of the malware files downloaded during the attack is a Visual Basic Script called GHETTOVIBE.
The script is placed inside the Windows Startup folder. That allows it to launch automatically every time the computer starts.
Campaign Uses Several Malware Families
Researchers found that the campaign does much more than install one piece of malware. It delivers several tools, and each one has a different job. One of the first tools is called SCOUTCURL.
It is a PowerShell script that gathers information about the infected computer. The attackers use this information before sending more malware. The campaign also spreads two loader programs called FLUIDLEECH and LOADLOOP. Their job is to install more malicious software after the first infection.
In one case, FLUIDLEECH pretended to be antivirus software. That disguise helped reduce suspicion and made the software appear safe. CERT-UA also found another tool named FREAKYPOLL.
This Python-based backdoor gives attackers remote access to infected computers. Once inside, they can continue controlling the system from another location. The operation does not stop with Windows devices.
Researchers discovered that the same group also targets Android phones. The attackers send harmful APK files through messaging apps. They disguise these files as security tools to convince people to install them.
After installation, the software places a backdoor called COWARDDUCK on the phone. According to CERT-UA, this malware can collect contact lists, copy files with common document extensions, track a victim’s live location, and upload stolen information through the Dropbox API.
The malware can also receive commands from remote servers. It can even use trusted services like Steam Community to receive instructions. That makes the activity harder to detect. CERT-UA said the campaign affected at least ten websites during June and July 2026.
Fake CAPTCHA Pages Help Hide the Attack
Researchers found that the attackers used a traffic-filtering service called Cloaking.House together with a custom framework named SMARTAXE. These tools help decide who sees the fake CAPTCHA page.
Not every visitor receives the same content. The attackers only show the malicious page to selected users. The manipulation of CAPTCHA systems is a growing concern, a threat actor has released alleged Cloudflare Turnstile bypass code on underground forums.
The fake CAPTCHA also uses a method called EtherHiding. Instead of storing its malicious web address inside the page, it collects that information from an Ethereum smart contract. This makes the harmful website harder for security tools to find.
According to the researchers, the campaign shows that even advanced nation-state hackers now rely on ClickFix attacks. Sandworm previously spread malware by using fake Microsoft Windows installers, Office setup files, and fake antivirus software shared through messaging services like Signal.
The latest campaign marks a clear change in strategy. Instead of hiding malware inside software downloads, the attackers now convince victims to run harmful commands themselves.
ClickFix Attacks Continue to Grow
Researchers said this campaign reflects a much larger trend across the cyber threat landscape. ClickFix attacks have become one of the fastest-growing ways to spread malware. Security researchers said these attacks have already delivered malware families such as OXLOADER, Mistic, SCMBANKER, ClickLock Stealer, TELEPUZ, and ACR Stealer.
Unlike older attacks that depended on software bugs, ClickFix campaigns focus on people. The attackers create fake messages that look real. They then persuade users to ignore their own security and manually run harmful commands.
According to CERT-UA, the latest findings show that social engineering continues to change. Attackers now depend more on deception than technical exploits to gain their first access to a victim’s device. Security experts said users should never run PowerShell or terminal commands provided by websites.
They also warned that any CAPTCHA asking users to copy and execute commands should be treated as a strong sign of malicious activity. The latest campaign shows that attackers no longer need complex software tricks to infect a device. Sometimes, a fake verification page and a few simple instructions are enough.
As ClickFix attacks continue to spread, security researchers say users should stay alert and question any website that asks them to run commands on their own computers.
