Ukraine Aid Groups Targeted Through Fake Zoom Meetings and Weaponized PDF Files
Cybersecurity experts have revealed the specifics of a coordinated spear-phishing campaign called PhantomCaptcha that aims to distribute a remote access trojan that leverages a WebSocket for command-and-control (C2) to organizations involved in Ukraine's war relief efforts.
According to a new report released today by SentinelOne, the October 8, 2025, activity targeted individual members of the Norwegian Refugee Council, the United Nations Children's Fund (UNICEF) Ukraine office, the International Red Cross, the Council of Europe's Register of Damage for Ukraine, and Ukrainian regional government administrations in the Donetsk, Dnipropetrovsk, Poltava, and Mikolaevsk regions.
It has been discovered that the phishing emails pose as the Ukrainian President's Office. They contain a boob...


