PhantomCaptcha Spyware Targets Ukraine NGOs with Fake Cloudflare Lure to Deploy WebSocket RAT

Researchers from SentinelLABS and Ukraine's Digital Security Lab uncovered a spearphishing campaign named "PhantomCaptcha" targeting humanitarian organizations in Ukraine, including the International Red Cross and UNICEF. The campaign utilized fake Cloudflare verification pages and weaponized PDFs to deploy a multi-stage PowerShell-based WebSocket RAT.

The attack, launched on October 8, 2025, involved emails impersonating the Ukrainian President's Office, leading victims to execute malware through a fake captcha page. The infection process included three stages: an obfuscated downloader, system reconnaissance, and a WebSocket RAT for remote command execution. The campaign is linked to the COLDRIVER threat cluster, known for targeting Western NGOs. Additionally, a mobile attack vector was identified, distributing a malicious Android app that harvested sensitive user data.