Russian State Hackers Use Fake CAPTCHAs to Force Victims to Self-Install Malware

Russian state-sponsored threat group UAC-0145 is running an active campaign against Ukrainian targets using ClickFix-style fake CAPTCHA pages to trick victims into manually executing data-stealing malware on their own machines. The Hacker News reports that Ukraine's Computer Emergency Response Team (CERT-UA) issued the advisory after observing the campaign in the wild.

What Happened

Victims land on what looks like a routine CAPTCHA verification page. Instead of clicking a checkbox, the page instructs them to open a Run dialog (Win+R) or terminal and paste a command — which silently installs a data-stealing payload. The technique is devastatingly simple: users trust their own hands more than a download prompt, and because the victim executes the command themselves, many endpoint controls that would flag a drive-by download are bypassed entirely. CERT-UA attributes the campaign to UAC-0145, a Russian state-sponsored group with nation-state resources behind its targeting and evasion.

Why It Matters

ClickFix is not new — it surfaced in criminal campaigns in 2024 — but state-sponsored adoption signals the technique has reached operational maturity. Critically, it is geographically portable: this wave is aimed at Ukrainian government and military targets, but the same lure infrastructure can be redirected at any population with minimal retooling. Prior ClickFix campaigns have hit legal firms, financial services, and IT administrators across the US and EU. The payload here is a credential and session-token stealer, meaning a single successful execution can hand an attacker persistent access to cloud services, VPNs, and internal tooling. For any organization with Ukrainian partners, vendors, or contractors in its supply chain, this is an active lateral risk right now.

What To Do

Immediately:

• Brief your helpdesk and security team on the ClickFix pattern. No legitimate CAPTCHA, software installer, or browser fix will ever ask a user to paste a command into Run or a terminal. Make that the single rule everyone knows.
• Push a one-paragraph user awareness note to anyone who handles external links, vendor portals, or government-adjacent communications.

This week:

• Audit GPO or Intune policies to restrict or at minimum alert on cmd.exe and powershell.exe launches from non-admin accounts, particularly those spawned via the Run dialog.
• Pull the IOCs from the CERT-UA advisory and cross-reference your DNS query logs and process-execution logs. If you have an EDR, check whether your vendor has published a UAC-0145 threat intel pack.
• If you have staff or services with exposure to Ukraine or Eastern European infrastructure, escalate those endpoints to active monitoring now.

Ongoing: ClickFix variants are appearing in MFA fatigue bypass flows and fake browser-update pages too. Add a ClickFix scenario to your phishing simulation rotation — user recognition is the primary control here, since the technique deliberately routes around technical defenses.