Fake CAPTCHA Tricks Ukrainians Into Running Malware

How the Attack Worked

CERT-UA has linked this campaign to UAC-0145, described as a sub-cluster within Sandworm. The core technique relies on compromised websites showing a fake CAPTCHA verification screen. Instead of clicking a checkbox, visitors are instructed to open a terminal and run a PowerShell command to "prove" they are human. That command can download and save a file, such as a VBS script, into the Windows Startup autorun directory, giving the attacker persistence on the victim's own machine. Follow-on PowerShell tooling then performs reconnaissance of the infected host.

A second track of the campaign targets Android users. Victims receive APK files through messaging apps, presented as security tools. Installing the APK delivers a full backdoor known as COWARDDUCK, which can collect contacts, targeted file types from common folders, and real-time location data, exfiltrating this information using services like the Dropbox API.

Why It Succeeded

The attack succeeds because it exploits a routine, low-attention moment: passing a CAPTCHA. Most users are conditioned to click through verification prompts quickly without scrutiny. By dressing the instruction as part of that familiar flow, attackers get victims to execute the infection step themselves rather than relying on an attachment or exploit. At least 10 compromised websites were used between June and July 2026, with traffic filtering and dynamic page modification so the fake CAPTCHA is shown selectively, which helps the pages blend in and avoid broad detection. The Android lure works similarly by borrowing the credibility of the phrase "security tool."

What to Watch For

• A CAPTCHA or "security check" that asks you to open a terminal or run a command
• Instructions to copy and paste PowerShell or terminal commands from a website
• Unsolicited APK files sent through messaging apps, especially ones claiming to be security tools
• Apps requesting broad access to files, contacts, or location shortly after installation
• Websites that behave differently depending on who is visiting

How to Build Resistance

Organizations should train staff, especially general and administrative employees plus mobile and field staff, that legitimate CAPTCHAs never require running commands. Any prompt to paste text into a terminal from a website should be treated as a likely malware delivery attempt and reported to IT. For mobile users, reinforce that software, including anything labeled a security tool, should only be installed from approved app stores or MDM channels, never from a messaging app link. Building this awareness helps staff recognize both the website-based ClickFix style lure and the Android APK lure used in this campaign.

How does the fake CAPTCHA attack work?

Attackers compromise websites to display a fake CAPTCHA verification that instructs visitors to run a PowerShell command in the terminal, which then downloads malware such as a VBS file placed in the Startup autorun directory.

Why would a CAPTCHA ask someone to run a command?

It should not. A real CAPTCHA never requires running PowerShell or terminal commands, and any instruction to do so on a website is a strong sign of a social engineering attack designed to infect the visitor's own machine.

What is the Android component of this campaign?

UAC-0145 also distributes Android APK files via messaging apps disguised as security tools, which actually install a backdoor called COWARDDUCK that can steal contacts, files, and real-time geolocation.

Who is being targeted by this campaign?

CERT-UA reports the activity targets Ukrainian users, including general staff, operations and administrative personnel, and mobile or field employees using Android devices.