UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware

**CERT-UA attributes a campaign to UAC-0145/Sandworm that compromised at least 10 websites and used fake CAPTCHA (ClickFix) lures to get victims to run PowerShell commands that download and persist data-stealing malware (e.g., GHETTOVIBE), reconnaissance scripts (SCOUTCURL), loaders (FLUIDLEECH, LOADLOOP), a Python backdoor (FREAKYPOLL), and an Android backdoor (COWARDDUCK); the actors employed Cloaking.House, SMARTAXE, EtherHiding (smart-contract domain retrieval), and abused legitimate services (Dropbox, steamcommunity.com) for C2 and exfiltration.**