Fake CAPTCHAs: The New Trick in Cyber Attacks

According to a recent report by The Hacker News, a Russian state-backed group known as UAC-0145 has been using fake CAPTCHA checks to trick Ukrainian users into infecting their own computers. Instead of proving you are human, these fake verification pages ask you to run a command that secretly installs malware. This technique, called ClickFix, shows how cyber criminals are constantly finding new ways to exploit everyday online tools.

What makes this attack significant is how it preys on trust. Most people accept CAPTCHAs as a normal part of browsing. By mimicking a familiar security measure, the attackers lower their victims’ guard. The campaign targeted at least ten compromised websites between June and July 2026, showing that even a small number of infected sites can cause widespread harm.

Why the ClickFix Method Matters Beyond Ukraine

This attack is a reminder that social engineering never goes out of style. The ClickFix strategy works because it asks the user to take action themselves. Instead of trying to break into a system, the attacker simply asks the victim to open the door. That shift puts the burden on individuals to spot the danger before they click.

The group behind this attack, Sandworm, is known for sophisticated operations. But the method they used here is surprisingly simple. It relies on a fake CAPTCHA page that displays a PowerShell command. Users who follow the instruction end up downloading a file that runs automatically. This technique can be adapted for any region, including Australia. Cyber criminals do not limit themselves to one country – they reuse successful tricks everywhere.

What This Means for Australian SMBs

Australian small and mid-sized businesses often think they are too small to be a target. But attacks like this show that cyber criminals target anyone who uses common software and trusts standard web interactions. A fake CAPTCHA could appear on a supplier’s website, a news site, or even a business tool that your staff use every day.

Because SMBs typically have fewer security resources, a single employee falling for this trick could lead to stolen data or a full system compromise. The malware used in these attacks can steal contacts, files, and even real-time location. For an Australian business, that could mean losing customer data, intellectual property, or access to critical systems.

What You Can Do Now

  • Train your team to spot unusual CAPTCHAs. Real CAPTCHAs never ask you to run commands or open terminals. If a verification page asks for anything beyond clicking images, it is likely a scam.
  • Restrict PowerShell and scripting tools on work computers. Many attacks rely on users running scripts. IT administrators can block PowerShell execution for standard users to prevent these commands from working.
  • Keep all software and browsers updated. Attackers often exploit known vulnerabilities in outdated programs. Regular updates close those holes.
  • Use endpoint protection that can detect malicious scripts. Modern antivirus and EDR tools can flag suspicious PowerShell commands before they run.
  • Create a clear reporting process for suspicious activity. If an employee sees a strange CAPTCHA, they should know who to contact immediately. Quick reporting can stop an attack before malware spreads.

For Australian SMBs looking to build stronger defences without overcomplicating operations, MS&VG provides practical cybersecurity guidance tailored to your size and industry. Staying informed about evolving threats like the ClickFix technique is the first step toward keeping your business safe.