Russian state-sponsored menace actors have been noticed leveraging the notorious ClickFix technique to trick Ukrainian targets into infecting their very own machines with data-stealing malware.
In keeping with the Laptop Emergency Response Group of Ukraine (CERT-UA), the exercise has been attributed to UAC-0145, a sub-cluster inside Sandworm, a sophisticated hacking unit affiliated with GRU, Russia’s major overseas navy intelligence company.
In these assaults, menace actors have been discovered to leverage faux CAPTCHA checks on compromised web sites that instruct potential targets to execute a PowerShell command within the terminal.
“The talked about command, for instance, might be meant for downloading and saving a VBS file within the Startup autorun listing; one of many variants of such a program was referred to as GHETTOVIBE,” CERT-UA mentioned in an alert.
The assaults additionally contain the usage of SCOUTCURL, a PowerShell script that performs fundamental reconnaissance by harvesting particulars in regards to the contaminated machine. Among the different malicious applications discovered within the contaminated endpoints are as follows –
- FLUIDLEECH and LOADLOOP, which act as loaders, with the previous masquerading as software program for eradicating laptop viruses.
- FREAKYPOLL, a Python backdoor
Not less than 10 web sites are assessed to have been compromised as a part of this marketing campaign between June and July 2026. Apart from profiting from Cloaking.Home, a site visitors filtering service that makes it attainable to serve totally different pages to totally different guests, the attackers have been discovered to make use of a bespoke device referred to as SMARTAXE to dynamically alter the content material of an online web page relying on the positioning customer and show a CAPTCHA examine.
The CAPTCHA content material to be injected into the online web page employs the EtherHiding approach to retrieve the area title of the distant useful resource from an Ethereum sensible contract utilizing an deal with specified within the supply code.
CERT-UA mentioned it additionally recognized the menace actor utilizing different assault strategies to interrupt into units, together with backdooring Android units by distributing APK recordsdata through messaging apps, by disguising them as safety instruments. The malware embedded within the APK file is a full-featured backdoor codenamed COWARDDUCK that may clandestinely acquire the next particulars –
- Contacts
- Information matching sure extensions (“.conf,” “.json,” “.ovpn,” “.txt,” “.doc,” “.docx,” “.xls,” “.xlsx,” “.pptx,” “.zip,” and “.rar”) from the directories: “DCIM,” “Paperwork,” “Downloads,” “Footage,” and “Alarms”
- Geolocation in actual time
In tandem, the malware makes use of the Dropbox cloud service API to add recordsdata, whereas retrieving instructions or knowledge from an exterior server or from reliable websites like steamcommunity[.]com.
The usage of ClickFix by the Kremlin-backed hacking crew marks a departure from prior campaigns which have made use of trojanized installers for Microsoft Home windows or Workplace containing a built-in backdoor or by means of bogus antivirus software program shared through the Sign messaging app.
The disclosure comes as ClickFix continues to be an efficient social engineering approach for malware supply throughout the cyber menace panorama, with dangerous actors leveraging it to distribute OXLOADER, Mistic, SCMBANKER, ClickLock Stealer, TELEPUZ, and ACR Stealer.
