UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware

Ravie LakshmananJul 19, 2026Malware / Cyber Warfare

Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their own machines with data-stealing malware.

According to the Computer Emergency Response Team of Ukraine (CERT-UA), the activity has been attributed to UAC-0145, a sub-cluster within Sandworm, an advanced hacking unit affiliated with GRU, Russia's primary foreign military intelligence agency.

In these attacks, threat actors have been found to leverage fake CAPTCHA checks on compromised websites that instruct prospective targets to execute a PowerShell command in the terminal.

"The mentioned command, as an example, could be intended for downloading and saving a VBS file in the Startup autorun directory; one of the variants of such a program was called GHETTOVIBE," CERT-UA said in an alert.

UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware

Other newsrooms on this story

Related reading

Now, even Russia's most elite hackers are using Clickfix to infect devices

SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users

Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks

Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse

ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update…

Fake Google and Cloudflare verification pages spread multiple malware families