Ukraine warns fake CAPTCHAs are being used to make you hack yourself

Ukraine's computer emergency response team, CERT-UA, has warned that the Kremlin-backed Sandworm hacking group is leveraging fake CAPTCHA checks on compromised websites that persuade users to run malicious code. Read more in my article on the Hot for Security blog.

The Kremlin-backed Sandworm hacking group is reportedly leveraging fake CAPTCHA checks on compromised websites that persuade users to execute a PowerShell command on their computers - tricking them into running malicious code. CERT-UA has attributed the attacks, which have surged this spring and summer against Ukrainian targets, to UAC-0145, a branch of Sandworm, the hacking unit known for some of Russia's most destructive cyber attacks in the past 10+ years, including ones against Ukraine's power grid.

Attack Mechanism

The latest attacks begin when a user visits a compromised webpage, where they're greeted by a fake CAPTCHA claiming they need to complete an extra step to prove that they are human. But unlike normal CAPTCHAs it is not about picking out the traffic lights or ticking a box. Instead, the fake CAPTCHA instructs the user to copy and paste a PowerShell command into their Windows computer. Of course, it's not worded quite like that. The instructions tell the user to press a key sequence that opens the Windows Run dialog, pastes the contents of the clipboard, and hits Enter - all without the victim realising what they have just unleashed. Because what they've just executed could: A genuine CAPTCHA will never ask you to:

Reconnaissance Tool

The downloaded code run on targeted computers runs a reconnaissance tool called ScoutCurl that collects information about the infected computer. This includes details about how the system is set up, what software is installed, files that are present, and browser data - all of which helps attackers determine whether the target is worth compromising further.

ClickFix Campaign

At least ten websites are estimated to have been compromised as part of the campaign since the beginning of June. ClickFix attacks like this are not new, and we have written about the threat many times in past articles. The uncomfortable truth is that ClickFix attacks persist because cybercriminals have found that they are very effective. This is in part because they do not rely on users being tricked into clicking on malicious links, but instead guide the victim through the process of infecting their own computers. Furthermore, the instructions are presented as "helpful" technical advice to resolve an issue, and can too easily be trusted by the unwary. Furthermore, they exploit the fact the widespread installation of legitimate tools like PowerShell which are trusted in many corporate environments.

Global Implications

ClickFix attacks are not just a problem for the people of Ukraine, already navigating a relentless barrage of cyberattacks from Russian hackers amid a long-lasting kinetic war. They are a problem for computer users worldwide. As a result, all computer users should take Ukraine's warning about the rise in ClickFix attacks as a timely reminder that the most dangerous threats often do not arrive in the form of an exploit of a zero-day vulnerability.

tags Graham Cluley is an award-winning security blogger, researcher and public speaker. He has been working in the computer security industry since the early 1990s. View all posts