A coordinated spearphishing operation uncovered by SentinelLABS and the Digital Security Lab of Ukraine has exposed a highly sophisticated campaign named PhantomCaptcha.
The operation specifically targeted members of humanitarian and government organizations engaged in Ukrainian war relief, including the International Committee of the Red Cross (ICRC), UNICEF Ukraine, the Norwegian Refugee Council, and several regional administrations.
The adversaries used fake emails, impersonating the Ukrainian President’s Office, to distribute weaponized PDF attachments designed to deliver a multi-stage remote access Trojan through an intricate social engineering chain.
Impersonation Emails and Lure Infrastructure
The PhantomCaptcha campaign began with emails sent on October 8, 2025, that carried an eight‑page document appearing to be an official communiqué from Ukraine’s presidential office.
The embedded hyperlink redirected recipients to zoomconference[.]app, a malicious domain crafted to resemble Zoom’s web platform but hosted on a Russian‑owned virtual server at IP address 193.233.23[.]81.
Once opened, victims encountered a simulated Cloudflare DDoS protection page that masked the true purpose of the attack. The fake gateway initiated a process designed to trick users into manually executing malicious code, thereby bypassing endpoint detection mechanisms.
Despite six months of preparation, the attacker’s infrastructure remained live for less than twenty‑four hours, indicating deliberate control and precise operational coordination.
The “ClickFix” Infection Technique
Rather than relying on exploits, the attackers used a “ClickFix”‑style infection chain that relied entirely on victim interaction. After a staged verification process, targets were presented with a fake Cloudflare page containing a reCAPTCHA checkbox.
Clicking it displayed instructions in Ukrainian directing users to copy a “token,” open the Windows Run dialog using the Win+R shortcut, paste the command, and execute it.
This seemingly routine step triggered a PowerShell script that silently downloaded the next payload from a command‑and‑control domain.
The approach effectively forced users to self‑execute malware, ensuring the payload evaded antivirus scanning and application‑control policies that monitor for automatic file execution.
SentinelLABS researchers noted this mechanism as a refined evolution of methods previously observed in “Paste and Run” campaigns.
Multi‑Stage RAT and Mobile Expansion
Subsequent analysis revealed the infection chain unfolded in three distinct PowerShell stages, ultimately deploying a lightweight WebSocket RAT capable of executing arbitrary commands and exfiltrating system data.
The final payload connected to wss://bsnowcommunications[.]com:80, enabling persistent remote control over infected hosts.
Researchers also discovered an associated Android spyware component spread via the domain princess‑mens[.]click, distributing a malicious application named princess.apk that collected device location, contacts, images, and network data.
The entire PhantomCaptcha framework demonstrates an adversary with high technical capability, meticulous planning, and likely links to Russia‑aligned threat clusters such as COLDRIVER, emphasizing continued cyberespionage pressures on Ukraine’s humanitarian and governmental networks.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
.jpg?fit=1068,580&ssl=1&description=PhantomCaptcha RAT - A coordinated spearphishing operation uncovered by SentinelLABS and the Digital Security Lab of Ukraine has exposed.){kind=link}