Russian state-sponsored threat actors operating under the designation UAC-0145 have been observed deploying the ClickFix social engineering technique to compromise Ukrainian targets, according to a new advisory from Ukraine's Computer Emergency Response Team (CERT-UA).
What Is ClickFix?
ClickFix is a well-documented attack technique that presents victims with a fake browser or CAPTCHA verification prompt. The prompt instructs the user to press Win+R, open PowerShell or the Run dialog, and paste a malicious command — effectively having the victim execute malware themselves. The technique sidesteps many traditional endpoint defenses because the user initiates the execution, bypassing application whitelisting and reducing the chance of automated detection at the email or browser gateway.
The strategy gained significant traction among both cybercriminal and state-sponsored groups in 2025 and has since become a standard tool in the APT playbook.
UAC-0145 Campaign Details
According to CERT-UA, UAC-0145 has been leveraging ClickFix-style fake CAPTCHA pages to deliver data-stealing malware to Ukrainian individuals and organizations. The lure pages are crafted to appear as legitimate human-verification screens — the kind commonly encountered on real websites. Victims who complete the fake verification unknowingly run a malicious payload on their device.
The ultimate goal of the campaign is data exfiltration: the malware is designed to harvest credentials, documents, and other sensitive data from compromised machines, consistent with Russia's ongoing intelligence-collection operations against Ukraine during the active conflict.
Why This Matters
State-sponsored use of ClickFix represents a convergence of high-sophistication threat actors with a technique originally popularized by opportunistic cybercriminals. UAC-0145 is one of several Russia-linked groups that CERT-UA tracks as conducting persistent cyber operations against Ukrainian government, military, and critical infrastructure targets.
The use of self-execution lures is notable because it:
- Bypasses EDR/AV that monitors process spawning from browsers or email clients
- Requires no vulnerability — the victim executes the payload themselves
- Scales easily — the fake CAPTCHA pages can be embedded in phishing emails, compromised sites, or malicious ads
Mitigation Recommendations
CERT-UA and cybersecurity researchers recommend the following defenses against ClickFix-style attacks:
- User awareness training: Educate users that no legitimate CAPTCHA or browser verification ever requires them to open a terminal or paste commands
- Restrict PowerShell and Run dialog access on endpoints where it is not required for business operations, using AppLocker or Windows Defender Application Control (WDAC)
- Enable Script Block Logging in PowerShell to capture executed commands for investigation
- Deploy endpoint detection rules for commands that include patterns like
mshta,curl,Invoke-Expression, or base64-encoded payloads executed via the Run dialog - Monitor DNS and network traffic for connections to known ClickFix infrastructure IOCs published by CERT-UA