Russian Military Hackers Trick Ukrainians Into Infecting Their Own PCs

Key points

• Ukraine's Computer Emergency Response Team (CERT-UA) has linked a new malware campaign to UAC-0145, a sub-group inside the Russian military hacking unit known as Sandworm.
• Sandworm is run by the GRU, Russia's military intelligence agency.
• The attackers use a trick called ClickFix: a fake CAPTCHA on a webpage persuades the victim to paste and run a malicious command themselves.
• The end goal is installing information-stealing malware, software designed to quietly copy passwords and browser data off the machine.

Ukraine's national cyber emergency team has caught Russian military hackers pulling an old trick on a new set of victims.

The technique is called ClickFix, and it's one of the more depressing things happening in security right now. It doesn't exploit a clever software bug. It exploits the person at the keyboard.

Here's how it works. You land on a webpage showing what looks like a normal CAPTCHA, one of those "prove you are human" puzzles. Instead of clicking pictures of traffic lights, the page tells you to press Windows+R, paste a line of text, and hit Enter. People do it. That line of text downloads malware onto their own computer.

Every antivirus and email filter you have gets bypassed, because the person sitting there is the one running the code. We covered a near-identical technique on 17 July when Microsoft flagged the ACR Stealer doing the same thing to business PCs.

Who is behind this campaign?

The attackers are UAC-0145, a sub-group inside Sandworm, one of the most notorious hacking units on the planet. Sandworm runs under the GRU, Russia's military intelligence service. CERT-UA attributed the activity, as first reported by The Hacker News.

Sandworm's record isn't subtle: it's the same broad outfit tied to the NotPetya wiper in 2017 and attacks on Ukraine's power grid. Info-stealers on individual laptops sound quieter than that, but stolen credentials are how the bigger intrusions start. The post-mortem will say, again, that the initial foothold was a browser session and a copy-paste.

What is the malware actually doing?

CERT-UA describes the payload as an information stealer, a program that rifles through the machine for anything useful: saved browser passwords and session cookies that let an attacker log in as you without needing the password at all.

For a Ukrainian target, the risk isn't just financial. Stolen session cookies from a government or defence worker's browser can hand Russian intelligence access to internal systems without triggering a single login alert. The GRU units behind this have faced joint EU and UK sanctions for exactly this kind of persistent access, as we reported on 13 July.

Should you worry if you're not in Ukraine?

The campaign targets Ukrainians, but ClickFix pages have appeared worldwide for over a year, pushed by criminal groups and state actors alike. It works on English-speaking office workers just as well.

If a website ever asks you to open the Windows Run dialog, or paste something into PowerShell or Terminal, close the tab. No legitimate CAPTCHA works that way. IT helpdesks don't ask for it unprompted either.

If you think you already followed those instructions, treat every password saved in your browser as compromised. Change them from a different device, then log out of all active sessions to invalidate any stolen cookies. Run a full scan after that.

The browser is the endpoint now, and the human clicking around inside it is the security control that failed first.