{"id":856,"date":"2026-07-28T10:40:27","date_gmt":"2026-07-28T05:10:27","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=856"},"modified":"2026-08-19T10:54:55","modified_gmt":"2026-08-19T05:24:55","slug":"clickfix-malware-uac-0145-sandworm","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/clickfix-malware-uac-0145-sandworm\/","title":{"rendered":"UAC-0145 Uses ClickFix Against Windows Devices and COWARDDUCK Against Android"},"content":{"rendered":"

Introduction<\/h2>\n

The latest ClickFix malware campaign shows how attackers continue to exploit user trust instead of software flaws. By presenting fake CAPTCHA verification prompts on compromised websites, the attackers reportedly convinced victims to execute malicious PowerShell commands themselves.<\/p>\n

CERT-UA attributes the activity to UAC-0145, a threat cluster it tracks as a Sandworm sub-cluster. Public reporting indicates that UAC-0145 targeted Ukrainian users and organizations through several compromise methods.<\/p>\n

Investigators assessed at least ten websites associated with the ClickFix activity as compromised during June and July 2026.<\/p>\n

For enterprise security teams, the campaign demonstrates why endpoint protection, mobile device management, and user awareness must work together to reduce the risk of user-assisted attacks.<\/p>\n

Incident at a Glance<\/h3>\n\n\n\n\n\n\n\n\n\n\n\n
Category<\/span><\/b>\u00a0<\/span><\/td>\nDetails<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
Threat cluster<\/span>\u00a0<\/span><\/td>\nUAC-0145 (tracked by CERT-UA as a Sandworm sub-cluster)<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Attack type<\/span>\u00a0<\/span><\/td>\nSocial engineering<\/a> malware campaign<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Initial access<\/span>\u00a0<\/span><\/td>\nFake ClickFix CAPTCHA prompts<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Primary targets<\/span>\u00a0<\/span><\/td>\nUkrainian organizations<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Platforms targeted through separate attack paths<\/span>\u00a0<\/span><\/td>\nWindows through ClickFix prompts; Android through disguised APK files<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Windows malware<\/span>\u00a0<\/span><\/td>\nGHETTOVIBE, SCOUTCURL, FLUIDLEECH, LOADLOOP, FREAKYPOLL<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Android malware<\/span>\u00a0<\/span><\/td>\nCOWARDDUCK<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
ClickFix findings publicly disclosed<\/span>\u00a0<\/span><\/td>\nJuly 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

How the ClickFix malware campaign worked<\/h2>\n

Unlike traditional malware campaigns that exploit software vulnerabilities, this attack relied on user-assisted execution.<\/p>\n

Compromised websites displayed fake CAPTCHA<\/a> instructions directing visitors to open a Windows terminal and paste a PowerShell command. CERT-UA found that one version of the command could download and save a VBS file in the Windows Startup autorun directory, enabling the script to run when the user signed in.<\/p>\n

Investigators observed the attackers using Cloaking.House<\/code> to serve different content to different visitors and a custom tool called SMARTAXE to modify webpages dynamically and display CAPTCHA prompts based on visitor characteristics. The injected CAPTCHA content also used an EtherHiding technique to retrieve the domain name of a remote resource from an Ethereum smart contract.<\/p>\n

<\/div>

OkoBot Malware Uses ClickFix and Fake GitHub Repositories<\/h4>

Discover how attackers use ClickFix lures and fake GitHub repositories to distribute malware.<\/p><\/div><\/div><\/div><\/a><\/div><\/div><\/div>\n

Windows malware chain<\/h2>\n

CERT-UA identified several malware families used during different stages of the campaign.<\/p>\n\n\n\n\n\n\n\n\n
Malware<\/span><\/b>\u00a0<\/span><\/td>\nReported purpose<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
GHETTOVIBE<\/span>\u00a0<\/span><\/td>\nVBS payload used for persistence<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
SCOUTCURL<\/span>\u00a0<\/span><\/td>\nPowerShell reconnaissance script<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
FLUIDLEECH<\/span>\u00a0<\/span><\/td>\nLoader disguised as antivirus software<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
LOADLOOP<\/span>\u00a0<\/span><\/td>\nMalware loader<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
FREAKYPOLL<\/span>\u00a0<\/span><\/td>\nPython backdoor<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Together, these components enabled reconnaissance, persistence, and the delivery of additional payloads. However, public reporting has not confirmed the complete objectives achieved during every intrusion.<\/p>\n

How COWARDDUCK expanded the attack to Android devices<\/h2>\n

The campaign also included an Android backdoor known as COWARDDUCK, reportedly distributed as APK files masquerading as security tools through messaging applications.<\/p>\n

According to the published technical analysis, the malware can collect:<\/p>\n