UAC-0145 ClickFix Campaign Uses Fake CAPTCHAs to Drop Malware

UAC-0145 is using fake CAPTCHA pages as a malware delivery trick, according to a new CERT-UA alert amplified by security researchers this weekend. The campaign targets Ukrainian users by placing ClickFix-style prompts on compromised websites and telling visitors to run a PowerShell command as if it were part of a verification check.¹

That detail matters because the lure no longer looks like a classic attachment or fake installer. The victim is asked to copy a command, open a Windows terminal, and execute it manually. HowToFix readers have seen the same social-engineering pattern in the recent ACR Stealer ClickFix campaign and in compromised website cases such as Ghost CMS ClickFix malware injection. UAC-0145 shows the same technique is now useful even to a Sandworm-linked cluster when it needs fast initial access.

The Hacker News reports that CERT-UA attributes the activity to UAC-0145, described as a sub-cluster within Sandworm, and says the campaign used fake CAPTCHA checks to push malware onto Windows devices.² Instead of exploiting a browser bug, the attackers exploit trust in a familiar web action. A person who thinks they are proving they are human may be giving the malware its install step.

What to Check After a Fake CAPTCHA Prompt

CERT-UA-linked reporting names several components defenders should recognize. One VBS sample, GHETTOVIBE, may be saved into the Windows Startup autorun directory. A PowerShell reconnaissance script called SCOUTCURL collects basic machine information. Other malware names tied to infected endpoints include FLUIDLEECH and LOADLOOP loaders, plus the FREAKYPOLL Python backdoor.²

The web-delivery side is also worth noting. At least ten websites were reportedly compromised between June and July 2026, with traffic filtering and page-modification tooling used to decide who sees the fake CAPTCHA. Public reporting names Cloaking.House, SMARTAXE, and an EtherHiding-style mechanism that retrieves remote-resource information through an Ethereum smart contract.³ For site owners, that means the incident is not only an endpoint problem. A legitimate site can become the staging surface that convinces visitors to run the command.

UAC-0145 activity also extends beyond Windows. CERT-UA said the group has distributed Android APK files through messaging apps while presenting them as security tools. The Android backdoor named COWARDDUCK can collect contacts, files, and real-time geolocation, and it uses legitimate services such as Dropbox or public websites as part of its communication flow.¹

For ordinary users, the rule is blunt: a CAPTCHA should never require opening Run, Terminal, PowerShell, Command Prompt, or installing an APK from a chat. If that happened, treat the machine or phone as exposed. Disconnect it from sensitive accounts, scan it, review browser sessions, and reset passwords from a clean device. If Windows Defender or another product reports a ClickFix-related detection, the dedicated Trojan:Win32/ClickFix.ABA removal guide is a useful recovery starting point.

For admins, triage should start with browser history around the fake CAPTCHA visit, PowerShell and script-block logs, Startup-folder changes, suspicious VBS files, unusual Python execution, and recently created files under user profile directories. On Android, review sideloaded APKs, app permissions, unknown-device admin rights, VPN profiles, and cloud-session activity. The strongest defensive control remains behavioral: block copy-paste command lures in user training, log script execution, and make it normal for employees to report a suspicious verification page before they try to solve it.

The campaign is a useful warning because it compresses several current attack trends into one incident: compromised websites, fake verification UI, user-executed scripts, cloud-backed command channels, and mobile backdoors. None of those pieces is exotic alone. Together, they make a fast and believable route from a normal web page to malware execution.

References

1. CERT-UA. Alert 6318437 on UAC-0145 activity and malware delivery. https://cert.gov.ua/article/6318437
2. The Hacker News. UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware. July 19, 2026. https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html
3. The Cyber Express. ClickFix Attacks Fuel UAC-0145 Cyber Campaigns in Ukraine. July 17, 2026. https://thecyberexpress.com/clickfix-attacks-fuel-uac-0145-cyber-campaigns/