The ClickFix attacks technique has become a key initial access method for the UAC-0145 cyber threat cluster, according to a new report from Ukraine's Computer Emergency Response Team (CERT-UA). The agency said the threat group, also tracked as Sandworm, APT44, Seashell Blizzard, and a subcluster of UAC-0002, has shifted its tactics during 2026, increasingly relying on fake CAPTCHA prompts and social engineering to compromise systems.

CERT-UA said it has worked with Ukrainian cybersecurity agencies for several years to investigate the activities of UAC-0145. While the group previously relied on infected software installers distributed through torrent websites, recent campaigns have increasingly used ClickFix to trick users into executing malicious PowerShell commands.

ClickFix Attacks Emerging as Primary Initial Access Vector

According to CERT-UA, infections recorded during the spring and summer of 2026 frequently began when victims visited compromised websites displaying fake CAPTCHA pages. Users were instructed to copy and execute PowerShell commands in their terminal, a phishing technique commonly referred to as ClickFix.

The downloaded commands were designed to retrieve malicious files such as GHETTOVIBE, a Visual Basic Script (VBS) that establishes persistence by placing itself in the Windows Startup directory.

Once executed, attackers could deploy SCOUTCURL, a PowerShell reconnaissance tool capable of collecting information about the compromised system, including device specifications, installed software, browser data, and local files before exfiltrating the information.

CERT-UA also observed malware loaders including FLUIDLEECH, disguised as antivirus software, and LOADLOOP being used during these campaigns.

Backdoors and Data Theft Tools Widely Deployed

The report noted that attackers continue using malware families such as KALAMBUR, SUMBUR, and TAMBUR after gaining access to victim systems.

To maintain remote access, the group relied on legitimate utilities including OpenSSH and Tor, forwarding local network ports such as 445, 3389, and 22 to attacker-controlled infrastructure.

CERT-UA also found malware designed to steal messaging data from Signal and WhatsApp, with stolen information reportedly exfiltrated using RSYNC.

On infected systems examined during cyber defense operations, investigators additionally identified FREAKYPOLL, a Python-based backdoor distributed as compiled bytecode (.pyc), providing attackers with persistent unauthorized access.

Compromised Websites Used to Deliver Fake CAPTCHA Pages

During June and July 2026, CERT-UA analyzed more than ten compromised websites involved in ClickFix attacks.

Investigators found attackers using both the Cloaking.House service and custom malware called SMARTAXE to dynamically modify legitimate webpages. SMARTAXE retrieves remote domains from blockchain smart contracts through Ethereum's eth_call function before displaying fake CAPTCHA pages or redirecting visitors to malicious content.

CERT-UA warned that any website used in these attacks should be considered compromised, potentially through vulnerable content management systems (CMS), stolen credentials, web shells, malicious plugins, modified website scripts, or server-side backdoors.

The agency urged website administrators and hosting providers to strengthen website security and respond quickly to incident reports.

Android Malware Also Part of UAC-0145 Operations

The report also highlighted growing use of Android malware distributed through messaging applications.

Attackers were observed sharing APK files disguised as security or antivirus tools. One such malware family, tracked as COWARDDUCK, functions as a full-featured Android backdoor capable of collecting device information, contacts, files, and real-time geolocation.

The malware targets files from directories including DCIM, Documents, Downloads, Pictures, and Alarms while searching for formats such as DOCX, XLSX, PPTX, ZIP, RAR, JSON, and OVPN files.

According to CERT-UA, COWARDDUCK uploads stolen files through the Dropbox API while receiving commands from legitimate services including Steam Community and StockMemory domains through proxy infrastructure.

Microsoft Sees Global Rise in ClickFix Campaigns

Microsoft Threat Intelligence and Microsoft Defender Experts also reported that ClickFix campaigns have increased significantly since early 2024, targeting thousands of enterprise and consumer devices globally each day.

Microsoft said the technique commonly delivers malware such as Lumma Stealer by persuading users to copy and execute commands through Windows Run, Windows Terminal, or Windows PowerShell. The campaigns are often combined with phishing, malvertising, and drive-by compromise techniques that imitate trusted brands.

Because ClickFix attacks rely on user interaction rather than exploiting software vulnerabilities directly, Microsoft recommends organizations strengthen user awareness and apply security policies that restrict unnecessary use of command execution tools.

The UK's communications regulator has launched a formal investigation into TikTok age verification, raising questions over whether the platform is adequately protecting children online under the country's Online Safety Act. The move comes as Britain prepares to introduce a social media ban for under-16s, with regulators warning that current age assurance methods used by some platforms may not be sufficient to prevent children from accessing harmful content.

The investigation follows the publication of a new Ofcom report that found age checks are becoming more common across online services, but significant gaps remain, particularly on social media platforms and some pornography websites.

Ofcom Questions TikTok Age Verification Method

According to Ofcom, some social media companies rely primarily on age inference methods to identify child users. These systems estimate a user's age based on their online behavior rather than verifying it directly.

The regulator said it has "serious doubts" about whether these methods are capable of meeting the standards required under the Online Safety Act. Ofcom believes some companies may be failing to correctly identify a significant number of children, potentially exposing them to harmful content, including pornography, self-harm, and suicide-related material.

As a result, Ofcom has launched a formal investigation into whether TikTok is complying with its legal duties to protect children from harmful content.

The regulator also warned that age inference alone will not be considered sufficient for enforcing the government's planned restrictions on social media use by children under 16. Platforms using such methods have been urged to adopt more effective age assurance technologies or provide compelling evidence demonstrating their effectiveness.

Age Checks Increase Across Online Services

The report found significant progress in the adoption of age checks since the Online Safety Act's child protection duties came into force in July 2025.

Between July 2025 and January 2026, the proportion of children encountering highly effective age checks increased from 25% to 43%.

Ofcom said more than 69 million age checks were completed across a sample of 32 UK services during the second half of 2025, representing a 23-fold increase compared to the previous six months.

The regulator also reported that all of the UK's top 10 pornography websites and most of the top 100 now have age verification measures in place.

Among children aged 8 to 14 who attempted to access pornography, only 8% visited such services. Half of those children reached only websites with age checks, while nearly 87% of their visits lasted less than 30 seconds, suggesting age verification discouraged continued access.

Search Engines Also Face Scrutiny

Despite the wider rollout of age assurance, Ofcom found that children can still easily discover pornography websites without age checks through Google Search and Bing.

Its analysis found that 33% of first-page Google search results and 54% of Bing results directed users to pornography websites lacking age verification or equivalent protections.

Following discussions with the regulator, Google and Bing have agreed to work with Ofcom on practical measures to reduce the visibility of such websites in search results.

Meanwhile, Ofcom continues enforcement against adult services that fail to comply with the law. The regulator has opened 23 investigations involving 88 adult service providers, with many either introducing age assurance or blocking UK users after enforcement action.

UK Moves Toward Social Media Ban for Under-16s

The investigation comes as the UK government advances plans to introduce a social media ban for under-16s, modeled on Australia's approach.

Under the proposal, platforms including TikTok, Snapchat, Instagram, Facebook, YouTube, and X would be prohibited from offering social media services to users under 16. Messaging services such as WhatsApp and Signal are not expected to be included.

The government also plans to introduce additional protections, including restrictions on livestreaming and communication with strangers for children under 16 across social media and certain gaming platforms. Similar safeguards would apply by default to users aged 16 and 17 to avoid what officials describe as a "cliff-edge" at age 16.

The proposed measures are expected to be presented to Parliament before the end of the year, with implementation targeted for Spring 2027.

Ofcom said it will submit a rapid assessment to Parliament by the end of October outlining what constitutes highly effective age assurance for verifying whether someone is over 16, helping shape future enforcement of the planned restrictions.