Loading threat actor…
PhantomCaptcha is a coordinated spear-phishing operation observed in October 2025 targeting organizations involved in Ukraine war relief and humanitarian support. Known targets included major aid organizations and local administrations supporting Ukraine. The campaign used social-engineering lures impersonating the Ukrainian President’s Office and delivered weaponized PDF documents that redirected victims to a fake videoconferencing site and a ClickFix-style fake CAPTCHA workflow designed to trick users into executing malicious PowerShell commands. The intrusion chain used multiple staged PowerShell payloads culminating in an in-memory WebSocket-based remote access trojan that provided remote shell capability. Reported functionality included host fingerprinting, encrypted command-and-control communications, arbitrary remote command execution, persistent reconnect behavior, data exfiltration, and the ability to deploy additional malware. Operators also demonstrated defense-evasion behavior, including obfuscation and disabling of PowerShell history. The campaign infrastructure showed signs of compartmentalization, with user-facing lure components taken down quickly while backend command-and-control remained active. Related activity linked to the same operators included infrastructure used to host obfuscated PowerShell malware earlier in 2025 and fake Android applications designed to steal contacts, media, and location data. Attribution has not been confirmed. Available reporting noted that the use of ClickFix-style social engineering may be consistent with tradecraft seen in some Russian intrusion activity, but no high-confidence actor attribution has been established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A spearphishing campaign targeting Ukrainian war relief organizations, using weaponized PDFs and fake CAPTCHA pages to deliver a multi-stage WebSocket RAT.
Coordinated spear-phishing activity targeting Ukraine war relief organizations using weaponized PDFs that lead to a fake Zoom site and a ‘ClickFix’-style fake Cloudflare CAPTCHA to trick victims into running a malicious multi-stage PowerShell chain that culminates in an in-memory WebSocket-based RAT for remote command execution and potential data exfiltration.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.