UAC-0145 Uses Fake CAPTCHA and Security Apps Against Ukraine

CERT-UA says the UAC-0145 threat cluster has been using several routes to compromise Ukrainian devices: trojanized Windows and Microsoft Office installers from torrent trackers, fake security tools sent through Signal, fake CAPTCHA pages that tell visitors to run PowerShell, and a counterfeit Android security app. The July 15 report connects these routes to named tools including GHETTOVIBE, SCOUTCURL, FREAKYPOLL, FLUIDLEECH, LOADLOOP, SMARTAXE, and COWARDDUCK.

The practical risk depends on what happened. Simply seeing a fake CAPTCHA is different from running its command. A Windows command, a file received in Signal, or a sideloaded APK should be treated as possible compromise because the campaign includes reconnaissance, remote access, persistence, and data theft.

How UAC-0145 gets initial access

These routes overlap, but they are not interchangeable. A real CAPTCHA never needs PowerShell, Windows Run, or Terminal. An antivirus update should come from the vendor or an official app store, not from an unexpected Signal conversation or APK attachment. Gridinsoft’s fake CAPTCHA ClickFix response guide explains the broader command-run versus page-view decision.

What the Windows ClickFix chain leaves behind

CERT-UA observed GHETTOVIBE as a VBS stage placed in the Startup folder. SCOUTCURL, a PowerShell reconnaissance script, could then collect system characteristics, installed programs, files, and browser data. Responders also found FREAKYPOLL, a Python backdoor distributed as compiled .pyc bytecode, while FLUIDLEECH was disguised as a virus-removal utility.

Check the following artifacts only as a set of leads, not as proof by filename alone:

• Work Copilot.vbs or Copilot Agent.vbs in the user Startup folder;
• update.cpython-314.pyc associated with FREAKYPOLL;
• ESET AV Remover.exe or an unexpected updatus.exe associated with FLUIDLEECH;
• reshV1_2.ps1 associated with SCOUTCURL;
• %LOCALAPPDATA%\SystemHelper\python\ and %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Copilot Agent.vbs.

A legitimate Copilot file or Python installation elsewhere is not automatically malicious. Match the path, creation time, parent process, network activity, and file hash against CERT-UA’s indicators. The campaign also used SMARTAXE on compromised websites to retrieve changing infrastructure from a smart contract, so blocking one domain does not repair an infected site or endpoint.

What to do after a command or file ran

1. Isolate the device. Disconnect Wi-Fi and wired networking. On a work, government, or military system, contact the security team before deleting files or clearing logs.
2. Preserve the lure and timing. Record the Signal account, website, domain, filename, command, and approximate execution time without running anything again.
3. Inspect persistence. Review Startup, Task Scheduler, services, PowerShell logs, recent files, and the paths listed above. The CERT-UA figure shows why the visible VBS file is only one stage.
4. Run full scans. Use the organization’s endpoint tooling or Microsoft Defender plus Gridinsoft Anti-Malware to check scripts, loaders, backdoors, startup entries, and related files.
5. Recover accounts from a clean device. Change passwords and revoke sessions for email, Signal, WhatsApp, Microsoft, Google, VPN, password managers, and other accounts used on the device. Stolen session data may remain useful after a password change.
6. Escalate network indicators. Unexpected forwarding of ports 445, 3389, or 22 through OpenSSH or Tor, or lateral movement from the infected device, requires incident response rather than home-PC cleanup.

A security tool may remove one script while a Startup copy, Python backdoor, service, scheduled task, browser session, or another loader remains. Reboot and scan again if alerts or network activity return.

Android checks for COWARDDUCK

COWARDDUCK was distributed as a fake protection APK. CERT-UA says it can collect device information, contacts, files from common folders, and real-time location. It used legitimate cloud and web services in parts of its command-and-control path, so seeing Dropbox, Steam Community, or DuckDuckGo traffic alone is not an indicator.

1. Put the phone in airplane mode if the APK was installed or granted permissions.
2. On a managed or sensitive device, preserve the APK name, download source, permissions, and install time for the security team before removal.
3. Review unknown apps, device-admin access, Accessibility permissions, VPN profiles, notification access, and apps allowed to install unknown packages.
4. Remove the untrusted app, install OS and security updates, and scan with the organization’s mobile-security tooling where available.
5. From a clean device, revoke sessions and change credentials used on the phone. Consider a factory reset when sensitive data was present or trust cannot be restored.

Website owners should treat the CAPTCHA as a breach

CERT-UA analyzed the ClickFix implementation on more than ten compromised websites. If a legitimate site serves the lure, removing the visible popup is not enough. Administrators should inspect the CMS and plugins, modified scripts and pages, administrator accounts, credentials, web shells, scheduled jobs, and server-side backdoors; rotate access credentials; and restore from a known-clean source where needed.

UAC-0145’s torrent-installer route also shows why a familiar product name is not a trust signal. Gridinsoft’s earlier report on trojanized Windows installers targeting Ukrainian organizations provides the historical supply-chain context, while this new CERT-UA report adds current ClickFix, Signal, and Android response clues.

References

1. CERT-UA. “Primary compromise vectors used by UAC-0145 as of July 2026.” State Service of Special Communications and Information Protection of Ukraine, July 15, 2026, accessed July 19, 2026. https://cert.gov.ua/article/6318437