Ukraine’s computer emergency response team, CERT-UA, has warned that Russian hackers are using fake CAPTCHA checks to trick people into compromising their PCs.
The Kremlin-backed hacking group Sandworm is reportedly using fake CAPTCHA checks on vulnerable websites to trick users into running a PowerShell command on their computers – tricking them into running malicious code.
CERT-UA attributes this attack, which took place this spring and summer against Ukrainian targets, to UAC-0145 – a branch of Sandworm, a hacking unit known for some of the most destructive cyber attacks of the past 10+ years, including this one against Ukraine’s power grid.
The latest attack begins when a user visits a compromised web page, where they are greeted with a fake CAPTCHA saying they need to complete an extra step to prove they are human.
But unlike regular CAPTCHAs it’s not about choosing robots or ticking a box. Instead, the fake CAPTCHA instructs the user to copy and paste a PowerShell command on their Windows computer.
Of course, it is not said that way.
The instructions tell the user to press a sequence key that opens a Windows Run dialog box, paste the contents to the clipboard, and hit Enter — all without the victim realizing what they just typed out.
Because what they just did is possible:
- download malware
- run PowerShell scripts
- or install remote access software on their machine
A real CAPTCHA will never ask you to:
- press Windows + R
- open the Run dialog box
- paste the command
- or press Enter to “verify you are human.”
The downloaded code runs on target computers using a scanning tool called ScoutCurl that gathers information about the infected computer. This includes information about how the system is set up, what software is installed, existing files, and browser data – all of which help attackers decide whether a target is worth further compromise.
At least ten websites are estimated to have been compromised as part of the campaign since early June.
ClickFix attacks like this are not new, and we have written about the threat many times in previous articles.
The uncomfortable truth is that ClickFix attacks continue because hackers have found them to be very effective. This is because the trusting users are not tricked into clicking malicious links, but instead guide the victim through the process of infecting their computers.
In addition, the instructions are presented as “helpful” advice to solve the problem, and can be easily trusted by the unwary. In addition, they take advantage of the fact of widespread installation of official tools such as trusted PowerShell in many corporate environments.
The ClickFix attack is not only a problem for the people of Ukraine, they are already navigating an endless series of cyberattacks from Russian hackers during a long-lasting kinetic war. They are a problem for computer users around the world.
As a result, all computer users should take Ukraine’s warning about the rise of ClickFix attacks as a timely reminder that the most dangerous threats often don’t come in the form of zero-day vulnerabilities.
