PhantomCaptcha RAT Uses Weaponized PDFs and “ClickFix” Cloudflare CAPTCHA Pages to Deliver Malware

On October 23, 2025, GBHackers reported on the PhantomCaptcha RAT campaign, which targeted humanitarian organizations involved in Ukrainian war relief. The campaign utilized weaponized PDFs and fake Cloudflare CAPTCHA pages to deliver a custom remote access trojan (RAT). Launched on October 8, 2025, it specifically aimed at members of the International Committee of the Red Cross, UNICEF, and other organizations, impersonating the Ukrainian Presidential Office.

The attack involved a multi-stage social engineering approach, where victims were tricked into executing malicious code themselves. The malware was delivered through an obfuscated PowerShell script, leading to data exfiltration and remote command execution. The attackers had prepared their infrastructure months in advance, indicating a sophisticated operation linked to Russian threat actors.