Loading story…
A sophisticated spearphishing campaign, identified as PhantomCaptcha, targeted key organizations involved in Ukraine's war relief efforts, including the International Committee of the Red Cross (ICRC), UNICEF, the Norwegian Refugee Council, and various Ukrainian regional government administrations. The attackers impersonated the Ukrainian President’s Office, sending emails with weaponized PDF attachments designed to lure recipients into clicking malicious links. These links led to a fake Cloudflare captcha page, which was actually a 'ClickFix'-style decoy, ultimately delivering a multi-stage WebSocket-based remote access trojan (RAT). The infrastructure supporting this campaign was hosted on Russian-owned servers and was only active for a single day, indicating a high level of operational security and planning, with evidence suggesting at least six months of preparation. The campaign’s technical sophistication included the use of a convincing eight-page document and a redirection to a domain masquerading as a legitimate Zoom website, further enhancing the credibility of the phishing attempt. Once the RAT was deployed, it enabled the attackers to execute arbitrary remote commands, exfiltrate sensitive data, and potentially deploy additional malware on compromised systems. Investigators also discovered a mobile attack vector, with fake Android applications designed to harvest geolocation data, contacts, media files, and other sensitive information from targeted devices. The selection of targets suggests the attackers were seeking intelligence on humanitarian operations, reconstruction planning, and international coordination related to Ukraine. Ukrainian government administrations in the Donetsk, Dnipropetrovsk, Poltava, and Mikolaevsk regions were specifically named among the targets. The campaign’s rapid disappearance after a single day of activity points to a deliberate effort to avoid detection and forensic analysis. SentinelLabs, in collaboration with the Digital Security Lab of Ukraine, led the investigation and public disclosure of the campaign. The use of Russian infrastructure and the focus on Ukrainian and international relief organizations suggest a possible geopolitical motivation, though attribution remains unconfirmed. The attack chain was designed to bypass traditional security controls by exploiting trust in official communications and leveraging multi-stage payload delivery. The campaign highlights the ongoing threat to humanitarian and governmental organizations operating in conflict zones, particularly those involved in Ukraine. Security researchers emphasize the need for heightened vigilance and advanced detection capabilities to counter such highly targeted and transient threats. The incident underscores the importance of cross-organizational intelligence sharing and rapid response to emerging spearphishing campaigns. Organizations are advised to review their email security protocols, educate staff on phishing risks, and monitor for indicators of compromise associated with the PhantomCaptcha infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On October 22, 2025, SentinelLABS and the Digital Security Lab of Ukraine publicly reported the PhantomCaptcha campaign and its technical details. The report noted overlaps with activity previously attributed to COLDRIVER but said attribution remained under investigation.
Infrastructure pivots uncovered a likely related but separately tracked Android malware operation using fake apps, including lures such as 'Princess Men’s Club.' The Android malware was designed to steal extensive device and personal data such as contacts, media, and location information.
Investigators observed the domain zoomconference[.]click being registered the day after the main lure infrastructure was used. The registration suggested the operators were maintaining or refreshing campaign infrastructure after the initial activity window.
Researchers found the user-facing lure infrastructure was active for only about a day, indicating deliberate exposure control and moderate operational security by the attackers. Backend command-and-control infrastructure remained active after the public-facing lures disappeared.
The intrusion delivered a three-stage PowerShell toolset culminating in an in-memory WebSocket-based RAT capable of arbitrary command execution and data exfiltration. Researchers said the infrastructure was largely hosted on Russian-owned or Russia-linked services.
The phishing PDFs redirected targets to a Zoom lookalike domain and then to a fake Cloudflare CAPTCHA page using a ClickFix/Paste-and-Run technique. Victims were tricked into executing a malicious PowerShell command that initiated a multi-stage infection chain.
On October 8, 2025, attackers launched a coordinated spearphishing campaign against NGOs and Ukrainian regional administrations involved in war relief, including organizations such as the Red Cross, UNICEF, and NRC. The emails impersonated the Ukrainian President’s Office and used weaponized PDFs to lure victims.
Researchers assessed the operators spent about six months preparing infrastructure for the PhantomCaptcha operation before launching the campaign. This preparation phase preceded the active spearphishing activity seen in October 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourcehackread.com
Open sourcesentinelone.com
Open sourcetherecord.media
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Russia-linked threat actor known as Callisto, also referred to as ColdRiver or Star Blizzard, attempted to compromise the nonprofit organization Reporters Without Borders (RSF) through a sophisticated phishing campaign. The attack involved credential-harvesting tactics, including the use of a ProtonMail account impersonating a trusted contact and a lure referencing a missing file. The phishing email, written in French and using a legitimate signature, prompted the recipient to request a follow-up document, after which a malicious link was sent. This link redirected the target to a spoofed ProtonMail login page designed to steal credentials. The campaign leveraged advanced adversary-in-the-middle (AiTM) phishing techniques and social engineering, with the attacker switching languages and using compromised websites to host malicious content. RSF, which supports journalists under threat and has been labeled an "undesirable organization" by the Kremlin, was specifically targeted, highlighting the ongoing focus of Russian APTs on NGOs and organizations supporting Ukraine. The attack was ultimately thwarted when ProtonMail blocked the attacker's account, preventing the malicious file from being delivered. Security researchers noted that similar lures were used against other organizations, and the campaign reflects a broader trend of Russian APTs using custom phishing kits and social engineering to target high-profile entities. The incident underscores the persistent threat posed by Russian state-aligned actors to civil society organizations and the need for robust email security and user awareness training.
Jun 29, 2026
Citizen Lab and Access Now documented a sophisticated spear-phishing campaign targeting Russian opposition figures, Belarusian and Russian civil society groups, independent media, international NGOs active in Eastern Europe, policy experts, funders, journalists, and at least one former U.S. ambassador. Researchers attributed one cluster to **COLDRIVER**—also tracked as **Star Blizzard**, **Callisto**, **TA446**, **Blue Charlie**, and **UNC4057**—a Russia-linked threat actor that multiple governments have associated with the FSB’s Centre 18, while identifying a separate but related phishing cluster as **COLDWASTREL**. The operations used highly personalized impersonation emails sent from compromised or lookalike accounts, along with fake encrypted or protected PDF lures that redirected victims through fingerprinting infrastructure to credential-harvesting pages spoofing services such as Gmail and ProtonMail. Investigators found overlaps with known COLDRIVER tradecraft, including Hostinger-registered domains, Let’s Encrypt or ZeroSSL certificates, LibreOffice 7.0 PDF metadata, randomized author names, and occasional HubSpot links, while COLDWASTREL showed distinct metadata, infrastructure, and domain patterns. The groups sought passwords, two-factor authentication codes, and session cookies, raising the risk of exposing sensitive identities, communications, relationships, and locations of organizations already facing Russian government repression.
Jul 12, 2026
The Russia-linked advanced persistent threat group UAC-0184, also known as Hive0156, has intensified its espionage operations against Ukrainian military and government entities by leveraging the Viber messaging platform as an initial attack vector. The group distributed malicious ZIP archives disguised as official documents, which contained Windows shortcut (LNK) files masquerading as Microsoft Word, Excel, and other document types. When opened, these LNK files executed a multi-stage infection chain, including the deployment of the Hijack Loader malware, which facilitated further compromise through techniques such as DLL side-loading, module stomping, and in-memory execution to evade detection. The phishing lures exploited sensitive themes, such as military personnel record changes and compensation issues, to increase the likelihood of successful compromise. The attack chain involved the use of PowerShell scripts to download additional payloads, with the malware designed to scan for and evade common security software. Persistence was established via scheduled tasks, and the campaign was observed to target high-value Ukrainian government bodies, including the Verkhovna Rada. Security researchers recommend strengthening security awareness, encryption, and access controls to mitigate the risk from such sophisticated phishing and malware delivery tactics. The campaign is expected to continue, with UAC-0184 evolving its methods and maintaining a focus on intelligence gathering against Ukrainian targets.
Jun 29, 2026