Fake CAPTCHAs Are Spreading Malware Across Ukraine—Here’s How the ClickFix Trick Works
Ukrainian devices are under a new wave of attack, and this time the bait is something internet users see every day: a CAPTCHA. The Computer Emergency Response Team of Ukraine (CERT-UA) has linked the campaign to UAC-0145, a sub-cluster within the notorious Russian hacking unit Sandworm, which operates under the GRU, Russia’s military intelligence agency.
The method is called ClickFix, and it’s deceptively simple. A user lands on a compromised or malicious site, gets hit with a fake CAPTCHA prompt, and is told to verify they’re human by running a command. That command? It’s actually a download-and-execute payload that infects the machine with data-stealing malware.
This isn’t a novel technique, but it’s proving effective. CERT-UA’s warning highlights how the attackers are tailoring the trick to Ukrainian targets, using lures that feel urgent and legitimate.
How the ClickFix Attack Unfolds
The attack chain starts with a phishing page or a compromised website. Visitors see a CAPTCHA that looks like the standard “I’m not a robot” checkbox or a puzzle. But instead of simply verifying, the page instructs them to open the Windows Run dialog (Win+R) and paste a command.
That command, often obfuscated, reaches out to a remote server, pulls down a malicious script, and executes it. Within seconds, the system is compromised. The malware deployed in these campaigns is designed to siphon credentials, browser data, and other sensitive information.
CERT-UA’s report notes that UAC-0145 has been active in this space for a while, but the ClickFix approach marks a shift toward social engineering that preys on user trust in familiar interfaces.
Why CAPTCHAs Are the Perfect Cover
CAPTCHAs are everywhere. Users are conditioned to solve them without thinking. That conditioning is exactly what the attackers exploit. A prompt that says “Press Win+R, paste this, and hit Enter” doesn’t raise suspicion because it’s framed as a verification step.
In many cases, the fake CAPTCHA even includes a progress bar or a countdown timer, adding pressure to act fast. This urgency is a classic manipulation tactic, and it works.
Who Is Behind UAC-0145?
UAC-0145 is a sub-cluster of Sandworm, a unit with a long history of disruptive cyber operations. Sandworm has been linked to attacks on Ukrainian infrastructure, including the 2015 and 2016 power grid blackouts, as well as the NotPetya worm that caused billions in damage globally.
This new campaign fits a broader pattern of Russian cyber aggression against Ukraine, which has intensified since the full-scale invasion in 2022. The focus on data theft suggests the attackers are after intelligence, not just disruption.
CERT-UA’s attribution is based on technical indicators and infrastructure overlaps with previous UAC-0145 operations. The agency has urged Ukrainian organizations and individuals to be vigilant.
How to Protect Yourself from ClickFix Attacks
The defense against ClickFix is straightforward, but it requires a shift in mindset. Here’s what security experts recommend:
- Never run commands from CAPTCHAs. Legitimate CAPTCHAs never ask you to open a Run dialog or execute a script. If a page does, close it immediately.
- Verify the source. If you’re on a site you didn’t intend to visit, or the URL looks off, don’t interact with it.
- Keep systems patched. Malware often exploits unpatched vulnerabilities. Regular updates reduce the risk.
- Use endpoint protection. Modern antivirus and EDR tools can detect and block the malicious scripts before they execute.
- Train users. Awareness is the first line of defense. If people know what ClickFix looks like, they’re less likely to fall for it.
What CERT-UA’s Warning Means for the Broader Threat Landscape
This campaign is a reminder that state-sponsored hacking groups are constantly evolving their tactics. ClickFix isn’t new—researchers have documented it since 2023—but its adoption by a group like Sandworm signals that it’s now a mainstream tool in the espionage playbook.
The targeting of Ukrainian devices is no surprise. But the same technique can be repurposed for any region. Organizations worldwide should treat fake CAPTCHA prompts as a potential red flag.
For more on how to spot phishing and social engineering attempts, check out our guide on recognizing phishing emails. And if you’re responsible for security in your organization, it’s worth reviewing endpoint security best practices to close gaps that attackers like UAC-0145 exploit.
The bottom line: trust nothing that asks you to run a command. That CAPTCHA might be more than an annoyance—it could be the door to a compromised network.
