Loading malware…
FluidLeech is a malware loader associated with Sandworm activity, including campaigns tracked by CERT-UA as UAC-0145 targeting Ukraine in 2026. It has been observed as part of multi-stage intrusion chains delivered through ClickFix-style social engineering on compromised websites, where victims are tricked into executing malicious PowerShell commands that fetch follow-on payloads. FluidLeech has also been linked to broader Sandworm tradecraft that includes fake security-themed lures and other socially engineered delivery methods.
In reported operations, FluidLeech functioned as a loader used after initial compromise to deploy additional tooling on selected victim systems. It has been described as masquerading as antivirus or virus-removal software, indicating a deception component intended to reduce suspicion during execution. The malware appeared alongside other Sandworm tools including GHETTOVIBE, SCOUTCURL, LOADLOOP, and the Python backdoor FREAKYPOLL. Within these intrusion chains, reconnaissance and victim triage preceded the use of additional payloads for longer-term access, and FluidLeech was one of the components used when operators chose to deepen access on valuable targets.
The malware is associated with Windows-focused infection flows because the observed ClickFix chains relied on PowerShell execution and related Windows persistence and scripting mechanisms. The broader campaigns using FluidLeech were directed at Ukrainian targets and formed part of Sandworm’s sustained espionage and intrusion activity.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
If the target was valuable, the threat actors used other malware samples to gain persistent access to the system. For example, FluidLeech, a fake antivirus software, and LoadLoop, a loader, were also used in the attacks.
...payloads such as FLUIDLEECH, LOADLOOP, and the Python backdoor FREAKYPOLL.
Серед лоадерів також відмічено використання програмних засобів FLUIDLEECH, замаскованого під програмний засіб для видалення "вірусів"
5 distinct techniques documented for this family, organized by ATT&CK tactic.
...набули поширення випадки розповсюдження програмних засобів реалізації кіберзагроз у месенджері Signal під виглядом необхідності встановлення "антивірусного захисту".
Victims visiting compromised websites are presented with a fake CAPTCHA security check and instructed to copy and paste a PowerShell command into their Windows computers.
That extra step is the infection.
FLUIDLEECH and LOADLOOP, which act as loaders, with the former masquerading as software for removing computer viruses...
The commands downloaded Visual Basic scripts and other malicious files, which in turn deployed several malware families known to be used by Sandworm.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.