More than 100 websites in Ukraine have been compromised by a dangerous scheme targeting Windows users

More than 100 compromised websites have been discovered in Ukraine that display a fake “I’m not a robot” verification to Windows users. Users are then prompted to run a specific command via Win+R, CMD, or PowerShell, which installs malware on their device.

Genuine CAPTCHAs and Cloudflare verifications do not require the execution of system commands. Therefore, if such a request appears on a website during verification, you should close the page immediately.

According to experts, a group identified as UAC-0277 is behind the campaign.

Instead of a regular CAPTCHA—a command to infect the computer

The scheme is designed so that the user perceives the attackers’ actions as a routine security check. A user visits a website and sees a page that mimics a Cloudflare verification. Such CAPTCHAs have long been commonplace; websites may indeed ask users to confirm that they are not automated programs.

However, in this case, the familiar procedure turns into a trap. Under the pretext of confirming “I’m not a robot,” the user is prompted to copy a specific command, then open a Windows system window and execute it. This is the crucial moment. If the user agrees and runs the suggested command, malware is downloaded and installed on their computer. In effect, the attackers force the victim to personally trigger the infection process.

CERT-UA identified the main sign of a dangerous CAPTCHA

Experts emphasize: a genuine CAPTCHA or Cloudflare verification should never require the user to run system commands on their computer. The following requests are particularly dangerous:

• press the Win+R key combination;
• open the "Run" window;
• to launch the CMD command prompt;
• open PowerShell;
• paste the copied text there;
• Execute the command provided by the website.

If a webpage asks you to do something like this, supposedly to confirm that you’re “not a robot,” you should close it immediately. This rule applies even if the website’s address looks familiar or you’ve visited the site before without any issues. As part of the current campaign, hackers are using legitimate—but previously compromised—websites.

The fraudulent verification does not appear for everyone

The campaign is designed to make malicious activity harder to detect. The fake page is not displayed to every visitor to the compromised site. According to CERT-UA, the attack specifically targets users of the Windows operating system.

Additionally, it matters how a user arrived at the site. The malicious page may appear if the user accessed the site via a search engine. Experts cite Google, DuckDuckGo, meta.ua, bigmir.net, and others as examples. There is also an additional restriction: such a page is displayed to a single user no more than twice within a 12-hour period.

This mechanism helps attackers conceal their attack. If a website owner or cybersecurity specialist simply opens the site, the fake CAPTCHA may not appear at all.

What happens if you execute the command

Pressing the keys does not, in and of itself, infect the computer. The danger arises when a person follows the sequence of actions suggested by the scammers and executes the received command. After that, malware is downloaded onto the device.

CERT-UA has reported that attackers are using LUNEXSTEALER. Its purpose is to gain access to valuable information on the infected device and create opportunities for further hacker activity. To make it harder for security systems to detect the threat, the malware disguises itself as legitimate files. Additionally, the attackers exploit vulnerabilities in Windows system drivers.

A fake “Microsoft Office Word Editor” may appear in the browser

After a successful infection, the attack does not stop at installing a single malicious component. A malicious browser extension disguised as “Microsoft Office Word Editor” may appear unnoticed on the victim’s computer.

The name is designed to give the impression that it is a standard Microsoft product or a document-processing tool. In reality, its capabilities are far more dangerous. According to experts, the malicious tool can steal usernames, passwords, and website browsing history.

In addition, the infection may give attackers the ability to remotely control the computer. The consequences of carelessly executing a command can be much more serious than simply a malfunctioning browser or computer. Accounts and other information stored on the device could be at risk.

Blockchain is used to orchestrate the attack

Another distinctive feature of the detected campaign is the way attackers manage their infrastructure. According to CERT-UA, hackers use blockchain technology, specifically the Polygon and Ethereum networks.

This approach allows them to quickly change the parameters of the malicious infrastructure and makes it more difficult to counter the campaign. At the same time, other methods are used to bypass Windows security, including exploiting vulnerable system drivers. As a result, the user sees only what appears to be a standard “I’m not a robot” verification, while behind it lies a multi-layered scheme for infection and information theft.

What to Do If a Website Asks You to Press Win+R

The basic rule for regular users is as simple as possible: do not execute any commands suggested by a website to complete a CAPTCHA. A standard CAPTCHA might ask you to check a box, select specific images, or perform another action directly on the page.

But a website does not need the user to open Windows system tools and manually run commands. Therefore, a request to press Win+R, open CMD or PowerShell, paste text there, and press Enter should be treated as a warning sign. In such a case, you should close the page and avoid copying or running anything from it.

It’s also advisable to restrict the installation of MSI packages without administrator privileges. Another security measure is to use the Microsoft Vulnerable Driver Blocklist—a mechanism for blocking known vulnerable drivers.

For browsers, experts recommend implementing a “whitelist” of extensions. This way, users will only be able to use pre-approved and verified applications, which reduces the risk of malicious components being installed without their knowledge.

What Owners of Compromised Websites Should Do

The problem affects not only visitors but also website owners. A compromised website may appear to continue operating normally, but a portion of its audience will be shown a malicious page.

If a website owner detects a fake verification page or has reason to believe that their site has been compromised, CERT-UA recommends reporting the incident as soon as possible. You can contact the specialists by email at [email protected]. The CERT-UA team can provide recommendations and help clean the website of malicious code.

The most important thing for regular users is to remember that a familiar website address does not in itself guarantee safety. If a seemingly ordinary “I’m not a robot” verification suddenly asks you to execute commands directly in Windows, you must not proceed.

This information was reported by the State Special Communications Service.