# Russia-Backed Cyber Attack: CAPTCHA Traps in Ukraine UAC-0145 spreads malware using ClickFix method. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/ff47095e-dc6a-4082-aee0-ce534c0a7b68 ## ClickFix Trap Method Russia-backed UAC-0145 group uses fake CAPTCHA checks to target Ukrainian users. Victims are tricked into executing PowerShell commands, leading to malware downloads. This highlights how effective social engineering can be in cyber attacks. ## Diverse Malware Arsenal The attack employs various malware like GHETTOVIBE, SCOUTCURL, FLUIDLEECH, and LOADLOOP, each serving different functions from data collection to device control. FLUIDLEECH notably disguises itself as antivirus software to deceive users. ## SMARTAXE and Dynamic Content Attackers use a custom tool called SMARTAXE to dynamically alter webpage content, displaying tailored CAPTCHA checks. The EtherHiding technique retrieves remote resource domains from Ethereum smart contracts, adding another layer of stealth. ## Android Device Infiltration UAC-0145 also targets Android devices via APK files distributed as security tools. The COWARDDUCK backdoor collects personal data and exfiltrates it via Dropbox API, showcasing the group's multi-platform threat capabilities. ## Old vs. New Tactics The ClickFix method marks a shift from Sandworm's earlier use of trojanized installers or fake antivirus software. This evolution underscores how threat actors continuously refine their social engineering techniques. ## Cybersecurity Alert CERT-UA's warnings are critical for organizations and individuals in Ukraine. Vigilance against seemingly trusted mechanisms like CAPTCHAs and keeping security measures updated is essential. The new frontier of cyber warfare is shaped by social engineering. ## Sources covering this story - https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._