At least **10 websites** were compromised between **June and July 2026**, and the infection vector was a fake CAPTCHA that forced users to run a PowerShell command. That’s the core of the new campaign uncovered by CERT‑UA, and it hinges on the notorious **ClickFix CAPTCHAs** technique.
Key Takeaways
- UAC‑0145, a sub‑cluster of **Sandworm** linked to the **GRU**, deployed fake CAPTCHA prompts on Ukrainian sites.
- The prompts instructed victims to execute PowerShell commands that dropped VBS files like **GHETTOVIBE** into the Startup folder.
- Additional payloads included **FLUIDLEECH**, **LOADLOOP**, and the Python backdoor **FREAKYPOLL**.
- Attackers also targeted Android devices with the **COWARDDUCK** backdoor delivered via malicious APKs.
- Custom tools such as **SMARTAXE**, **SCOUTCURL**, and the EtherHiding technique enabled dynamic page content and reconnaissance.
Historical Context
Russian‑backed cyber groups have a long history of weaponising web‑based lures. Early campaigns often relied on trojanized installers that masqueraded as legitimate software updates. Those installers would bundle malicious binaries and run them with elevated privileges. Another common vector was bogus antivirus utilities that claimed to “clean” an infected system while actually delivering payloads.
Those tactics, while effective, required a certain level of user interaction—usually a double‑click on a deceptive dialog. Over time, adversaries refined their approach, moving from static downloads to more dynamic delivery mechanisms. The shift toward real‑time content manipulation allowed threat actors to tailor attacks on a per‑visitor basis, reducing the chance of early detection.
Enter the ClickFix CAPTCHA. By hijacking a familiar user interface element, attackers exploit a trust relationship that users rarely question. The technique builds on earlier social‑engineering tricks but adds a layer of immediacy: the victim is asked to paste a command directly into a terminal, bypassing the need for a separate download step.
This evolution mirrors a broader trend seen across multiple threat clusters. The focus has moved from broad‑brush malware drops to precision‑targeted execution paths. Each step in the chain—CAPTCHA, PowerShell one‑liner, VBS drop—acts as a gate that filters out casual users while letting the intended victims proceed.
ClickFix CAPTCHAs Weaponized by UAC‑0145
The campaign marks a stark shift from earlier Russian‑backed operations that relied on trojanized installers or bogus antivirus software. Instead, threat actors now hijack the CAPTCHA experience to coerce users into running malicious code. That’s a clever social‑engineering twist that catches even seasoned developers off guard.
According to the Computer Emergency Response Team of Ukraine (CERT‑UA), the attackers compromised compromised websites and used a traffic‑filtering service called Cloaking.House to serve different content based on the visitor. That’s how the fake CAPTCHA was delivered only to targeted users, while other visitors saw a normal page.
How the CAPTCHA Trick Works
The injected CAPTCHA page tells the visitor to open a terminal and paste a PowerShell one‑liner. The command typically downloads a VBS file and writes it to the Startup autorun directory. That’s the entry point for the malware.
“The mentioned command, as an example, could be intended for downloading and saving a VBS file in the Startup autorun directory; one of the variants of such a program was called GHETTOVIBE,” CERT‑UA said in an alert.
After the VBS drops, the system runs a suite of secondary payloads. That’s where **FLUIDLEECH** and **LOADLOOP** come in, masquerading as virus‑removal tools while actually loading additional malicious modules.
PowerShell is the delivery workhorse. The one‑liner often uses Invoke-WebRequest or bitsadmin to fetch the VBS payload from a remote server. Once the file lands in the Startup folder, Windows automatically executes it on the next login. The VBS script then launches the next stage without user awareness.
Because the command is presented as a simple copy‑paste step, many users assume it is safe. The CAPTCHA itself reinforces that perception, making the request appear as part of a routine verification flow.
Malware Payloads Delivered
Beyond the VBS drop, the campaign deployed a Python backdoor named **FREAKYPOLL**, which gives the attacker remote command execution. That’s a serious escalation because Python is often trusted on many servers.
Another tool, **SCOUTCURL**, runs a quick PowerShell reconnaissance script that harvests system details—CPU, OS version, and network configuration. That’s useful for tailoring later stages of the attack.
On Android, the threat actors distributed malicious APKs via messaging apps, disguising them as security utilities. Those APKs contain the full‑featured backdoor **COWARDDUCK**, which silently exfiltrates contacts, many file types, and real‑time geolocation.
Exfiltration is handled through the Dropbox API, while command‑and‑control traffic can be pulled from legitimate sites like steamcommunity.com. That’s a clever way to blend malicious traffic with normal web activity.
Each payload follows a clear purpose. **FLUIDLEECH** pretends to clean a system but actually injects additional code. **LOADLOOP** keeps the malicious process alive, ensuring persistence even after reboots. The Python backdoor offers a flexible command channel that can adapt to different environments.
Infrastructure Behind the Attack
The operation relied on a bespoke tool called **SMARTAXE** to dynamically rewrite page content. That’s how the attackers could swap a normal landing page for a malicious CAPTCHA in real time, depending on the visitor’s IP or other fingerprints.
SMARTAXE works in concert with Cloaking.House, which lets the attackers serve multiple versions of a page from the same URL. That’s a technique often used in benign A/B testing, but here it’s weaponized.
EtherHiding Technique
The CAPTCHA content itself pulls a domain name from an Ethereum smart contract using an address baked into the source code. That’s the so‑called EtherHiding technique, and it adds a layer of obfuscation that bypasses typical domain‑based blocking.
Because the domain is resolved on‑chain, traditional DNS sinks can’t easily block the malicious server. That’s why analysts are warning that such blockchain‑backed lookups could become a new thorn in defenders’ sides.
Broader Implications for Ukrainian Cyberdefense
This campaign shows that the Kremlin‑backed group is adapting its playbook to exploit web‑based social engineering tricks. That’s a warning sign for organizations that rely heavily on web portals for user interaction.
- Defenders must scrutinize any unexpected CAPTCHA prompts, especially those that ask for command‑line input.
- Security teams should monitor PowerShell activity for download‑and‑save patterns targeting the Startup folder.
- Android app vetting processes need to be hardened against APKs masquerading as security tools.
- Network monitoring should include checks for unusual Dropbox API calls and traffic to steamcommunity.com that doesn’t match normal usage patterns.
- Blockchain‑based domain resolution techniques like EtherHiding require new detection rules at the proxy level.
the campaign underscores the importance of a layered defense strategy that includes both endpoint protection and web‑application security. That’s something every Ukrainian organization should take to heart.
What This Means For You
If you manage a web service that serves Ukrainian users, you need to audit any third‑party services that insert dynamic content. That’s the first line of defense against a SMARTAXE‑style injection. Make sure your CDN or traffic‑filtering layer can’t be hijacked to serve malicious CAPTCHAs.
Developers should also enforce strict PowerShell execution policies and disable the automatic execution of downloaded scripts. That’s a simple config change that can stop the initial VBS drop from ever reaching the Startup folder.
For Android developers, the takeaway is clear: never let an app install itself from an unverified source, and always verify the signature of any security‑related utility you bundle. That’s the only way to keep the **COWARDDUCK** backdoor from slipping onto user devices.
Finally, security ops should add alerts for EtherHiding patterns—specifically, calls to Ethereum nodes that resolve domain names used in web content. That’s a proactive step that can catch the use of blockchain‑based C2 channels before they cause damage.
Scenario one: a small e‑commerce site uses a third‑party widget to display a “prove you’re human” box. The widget is compromised, and a targeted visitor sees a PowerShell prompt instead of a classic image puzzle. The visitor copies the command, and the site’s server becomes a foothold for the attacker.
Scenario two: a SaaS startup hosts a dashboard that relies on real‑time analytics. An attacker injects a SMARTAXE snippet into the analytics script, causing only users from a specific IP range to receive the fake CAPTCHA. Those users inadvertently grant the attacker a persistent foothold.
Scenario three: a mobile payment app distributes an “anti‑virus” update via a messaging platform. The update is a malicious APK that carries COWARDDUCK. Once installed, the app exfiltrates transaction logs and location data, compromising both users and merchants.
These examples illustrate how a single compromised component can cascade into a broader breach. They also show why each layer—web, endpoint, mobile—needs its own set of safeguards.
As threat actors keep refining social‑engineering tricks, the security community must keep pace with equally sophisticated detection and response tactics. That’s the ongoing battle we face.
Will future campaigns blend more blockchain tricks with classic CAPTCHAs, or will defenders develop new heuristics that render such attacks ineffective? Only.
Key Questions Remaining
What timeline will the attackers follow for subsequent drops? The current campaign suggests a staged approach, but the exact cadence is unknown.
How many additional domains are hidden behind the EtherHiding contracts? Analysts can see the contract address, yet the full list of resolved names remains undisclosed.
Can existing web‑application firewalls be tuned to detect the SMARTAXE pattern without breaking legitimate traffic? Early tests show promise, but a universal rule set is still in development.
Will Ukrainian organizations adopt blockchain‑aware filtering at the ISP level, or will the solution stay confined to enterprise proxies? The answer will shape the next wave of defensive measures.
Answers to these questions will guide the next round of mitigations. Until then, vigilance remains the best tool.
Sources: The Hacker News, Cybersecurity‑Ukraine Gazette
