UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware

The Ukrainian landscape of cyber warfare has shifted once again as a sophisticated state-sponsored threat actor, identified as UAC-0145, deploys a deceptive social engineering technique known as "ClickFix." This latest campaign, tracked by the Computer Emergency Response Team of Ukraine (CERT-UA), weaponizes the psychological trust users place in routine security protocols. By presenting targets with fabricated CAPTCHA challenges or browser error messages, the attackers manipulate victims into executing malicious scripts under the guise of verifying their humanity or fixing a technical glitch. This approach marks a departure from traditional spear-phishing attachments, opting instead for a tactic that bypasses many automated email filters by placing the burden of infection on the user’s manual actions.

Contextually, UAC-0145 is not an isolated entity but is understood to be a specialized sub-cluster of Sandworm, one of the Russian GRU’s most notorious and destructive cyber-espionage units. Sandworm has a decade-long history of aggressive operations in Ukraine, ranging from the 2015/2016 power grid blackouts to the devastating NotPetya pseudo-ransomware attack in 2017. While Sandworm is often associated with high-impact disruptive attacks, the emergence of UAC-0145 signals a refined focus on persistent espionage and data exfiltration. By iterating on existing social engineering frameworks, the group is ensuring that its footprint remains effective even as Ukrainian defenses become more resilient to old-school malware delivery methods.

The mechanics of the ClickFix strategy are disturbingly simple and exploit the "PowerShell" execution flow. When a victim visits a compromised website or follows a link in a themed email, they are greeted by a fake dialogue box—often mimicking a Google Chrome or Microsoft Word error. To "solve" the issue, the user is instructed to copy a string of code and paste it into their system’s terminal (Win+R followed by a paste action). This code is a base64-encoded command that, once executed, downloads and runs an info-stealer. This bypasses the typical "double-click an .exe" warning signs that modern users have been trained to fear, instead leveraging a series of manual steps that feel, to the uninitiated, like a legitimate technical troubleshooting process.

The business and technical implications of this shift are significant for the broader cybersecurity industry. We are witnessing the democratization of high-end lure kits; ClickFix began as a tool for financially motivated cybercriminals before being adopted by state actors like those in Russia and North Korea. For organizations, this means that employee "security awareness" training must evolve beyond spotting typos in emails. Defense-in-depth now requires blocking the execution of PowerShell from unauthorized user contexts and monitoring the clipboard for suspicious command-line strings. It also highlights a growing trend where attackers prioritize the "living off the land" (LotL) philosophy, using built-in system tools rather than proprietary malware to maintain a lower profile.

In the competitive landscape of regional conflict, these tactics suggest a pivot toward long-term intelligence gathering. The malware deployed in these specific campaigns is often designed for stealthy data harvesting—stealing credentials, documents, and session markers—rather than immediate destruction. This allows the GRU to map out Ukrainian civilian and military infrastructure from the inside, providing a tactical advantage that can be leveraged during kinetic military operations. As the kinetic war remains in a stalemate, the digital front is intensifying, with both sides seeking to compromise the basic digital trust of the population.

What to watch next is the inevitable migration of these tactics into a broader global context. The success of UAC-0145 in Ukraine often serves as a pilot program for wider Russian operations against NATO countries or democratic elections. As generative AI makes it easier to create pixel-perfect, localized lures in any language, the ClickFix methodology is likely to become a mainstay of the 2024-2025 threat landscape. Cybersecurity firms will need to accelerate the development of browser-based protections that can detect when a site is prompting a user to interact with their system terminal, effectively closing the gap between web-based threats and local OS execution.