CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

PhantomCaptcha Campaign Targets Ukraine Aid Groups

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A coordinated spear-phishing campaign, dubbed PhantomCaptcha, targeted organizations involved in Ukraine's war relief efforts. The campaign delivered a remote access trojan (RAT) using a WebSocket for command-and-control (C2). The attack took place on October 8, 2025, and impersonated the Ukrainian President's Office, using weaponized PDFs and fake Zoom meetings to trick victims into executing malicious PowerShell commands. The malware performed reconnaissance and enabled remote command execution and data exfiltration. The campaign targeted members of the International Red Cross, Norwegian Refugee Council, UNICEF Ukraine, Council of Europe's Register of Damage for Ukraine, and Ukrainian regional government administrations. The malware was hosted on Russian-owned infrastructure and connected to a remote WebSocket server for C2 operations.

Timeline

  1. 22.10.2025 19:55 1 articles · 23h ago

    PhantomCaptcha Campaign Targets Ukraine Aid Groups on October 8, 2025

    On October 8, 2025, a coordinated spear-phishing campaign, dubbed PhantomCaptcha, targeted organizations involved in Ukraine's war relief efforts. The campaign used spear-phishing emails impersonating the Ukrainian President's Office, containing a booby-trapped PDF with an embedded link to a fake Zoom site. The fake Zoom site redirected victims to a malicious PowerShell command via a fake Cloudflare CAPTCHA page, leading to the execution of an obfuscated downloader that retrieved a second-stage payload. The final payload was a WebSocket RAT hosted on Russian-owned infrastructure, enabling arbitrary remote command execution and data exfiltration.

    Show sources
    Open in new tab

Information Snippets