Ukraine warns fake CAPTCHAs are being used to make you hack yourself
Ukraine's CERT-UA has warned that Russian hackers, specifically a branch of the Sandworm group, are using fake CAPTCHA challenges to trick users into executing PowerShell commands on their own computers, installing reconnaissance software. This campaign has been ongoing since June and is targeting Ukrainian websites, but the tactic poses a risk to computer users globally.
Ukraine’s computer emergency response team, CERT-UA, has issued a warning about a growing campaign by Russian hackers, specifically a branch of the Sandworm hacking group, utilizing fake CAPTCHA challenges to compromise users’ own PCs. The Kremlin-backed Sandworm unit has been responsible for some of Russia’s most destructive cyberattacks in the past 10+ years, including attacks against Ukraine’s power grid.
The latest attacks begin when a user visits a compromised webpage, where they are presented with a fake CAPTCHA claiming they need to complete an extra step to prove they are human. Unlike normal CAPTCHAs, which involve selecting images or ticking boxes, these fake CAPTCHAs instruct the user to copy and paste a PowerShell command into their Windows computer.
Users are told to press a key sequence that opens the Windows Run dialog, paste the contents of the clipboard, and hit Enter – all without realizing they are unleashing malicious code. The downloaded code then runs a reconnaissance tool called ScoutCurl, which collects information about the infected computer, including details about system setup, installed software, files present, and browser data. This information helps attackers determine whether the target is worth further compromising.
At least ten websites are estimated to have been compromised as part of this campaign since the beginning of June. These ClickFix attacks are not new, and we have previously written about this threat. The uncomfortable truth is that these attacks persist because cybercriminals have found that they are very effective, as they don’t rely on users clicking on malicious links, but instead guide the victim through the process of infecting their own computers. The instructions are presented as ‘helpful’ technical advice to resolve an issue, and can too easily be trusted by the unwary, exploiting the widespread installation of legitimate tools like PowerShell which are trusted in many corporate environments.
ClickFix attacks are not just a problem for the people of Ukraine, already navigating a relentless barrage of cyberattacks from Russian hackers amid a long-lasting kinetic war. They are a problem for computer users worldwide. Therefore, all computer users should take Ukraine’s warning about the rise in ClickFix attacks as a timely reminder that the most dangerous threats often do not arrive in the form of an exploit of a zero-day vulnerability.