What Happened
Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their own machines with data-stealing malware. According to the Computer Emergency Response Team of Ukraine (CERT-UA), the activity has been attributed to UAC-0145, a sub-cluster within Sandworm, an advanced hacking unit affiliated with GRU, Russia's
Why It Matters
The article reports that Russian-linked UAC-0145/Sandworm is using fake CAPTCHA/ClickFix lures on compromised websites to trick Ukrainian users into running malicious PowerShell commands, resulting in malware infection. The campaign is described as social engineering rather than exploitation of a software vulnerability. RealGround implication: this is primarily a cyber threat intelligence and user-execution malware issue, so advisory and red-teaming services are more relevant than AI-specific product risk services.
RealGround Analysis
This signal maps to malicious AI use. Organizations using AI agents, LLM APIs, SaaS integrations, or sensitive data workflows should review whether this class of issue could create unauthorized tool execution, data leakage, weak approval gates, or unmanaged supply-chain exposure.
Recommended Actions
- Restrict AI agent tool permissions and production write paths.
- Review sensitive data access across prompts, logs, embeddings, memory, and SaaS integrations.
- Add human approval workflows for high-impact or state-changing actions.
- Run prompt injection and indirect prompt injection tests against affected workflows.
- Document the owner, control gap, and remediation deadline for this risk class.
Source
https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html