A Ukrainian-language "shared document" phishing wave used a fake reCAPTCHA "verify you are human" ClickFix page to trick victims into pasting and running.
Social Engineering Examples·5 sources
On 31 October 2024, Proofpoint researchers identified a Ukrainian-language phishing campaign, later assessed to overlap with the Russia-linked threat cluster UAC-0050, targeting organizations in Ukraine. Emails purported to share documents or requested information and carried compressed HTML attachments, a technique (HTML smuggling) that helps the malicious payload evade attachment scanning.
Opening the attachment rendered a fake webpage using the "reCAPTCHA Phish" ClickFix technique: an open-source toolkit published to GitHub in mid-September 2024 "for educational purposes" that Proofpoint began seeing abused in the wild within days of release, itself modeled on a technique threat actors had already been running against video-streaming sites since August 2024. The page displayed a "Verify You Are Human" CAPTCHA-style challenge that, instead of a real bot check, instructed the victim to copy a provided string and paste it into the Windows Run dialog or a PowerShell terminal and press Enter.
Notably, the landing page itself was in English even though the originating email and attachment names were in Ukrainian. Victims who followed the instructions triggered a first PowerShell command that launched a second PowerShell script using a BITS transfer to download and execute a payload Proofpoint assessed as "suspected Lucky Volunteer," a rarely observed infostealer previously seen only once before, in a March 2023 TA579 campaign where it was dropped by AresLoader.
This was one of several ClickFix/fake-CAPTCHA campaigns Proofpoint catalogued in its 18 November 2024 threat brief (alongside a GitHub-notification campaign delivering Lumma Stealer to 300+ organizations, a Swiss Ricardo-impersonation campaign, and a NetSupport RAT campaign), but the UAC-0050 wave was distinguished as the only one involving a suspected nation-state espionage actor rather than a purely financially-motivated cybercrime cluster.
(1) Lure: a Ukrainian-language email claiming to share a document or requested information. (2) Delivery: the email carried a compressed HTML attachment (HTML smuggling) rather than a link or executable, which evades many gateway filters. (3) Fake verification: opening the attachment rendered a webpage using the open-source "reCAPTCHA Phish" ClickFix toolkit (released on GitHub mid-September 2024 "for educational purposes" and adopted by multiple threat clusters within days), notably the landing page itself was in English despite the Ukrainian-language email and attachment names. (4) Self-execution: the page told the victim to "verify you are human" by copying a provided string and pasting it into the Windows Run dialog or a PowerShell/terminal window and pressing Enter.
A genuine CAPTCHA never asks this. (5) Chain: the pasted command ran a first PowerShell stage that invoked a second PowerShell script using BITS transfer (a living-off-the-land download mechanism) to fetch and execute a payload Proofpoint assessed as the rarely-seen "Lucky Volunteer" infostealer (previously seen only once before, dropped by AresLoader in a March 2023 TA579 campaign), which then reached out to a hard-coded C2. No exploit or unpatched vulnerability was used anywhere in the chain: every step required the victim's own hands-on-keyboard action.
Lure: a routine-sounding Ukrainian business email about a shared document or requested information, the kind of message an employee expects and opens without hesitation. Tell: (1) a "CAPTCHA" that asks you to press Win+R (or open a terminal), paste, and hit Enter is never a real CAPTCHA; legitimate bot checks only require a checkbox click or image selection, they never touch your clipboard or ask for keyboard shortcuts; (2) the mismatch between a Ukrainian-language email/attachment and an English-language "verification" landing page was itself an inconsistency; (3) any unsolicited instruction that walks you through "fixing an error" by running a command you can't read in full (the Run dialog truncates long pasted strings) is a red flag used across ClickFix variants specifically to hide the malicious payload in plain sight.
Proofpoint publicly documented the campaign with full indicators of compromise (delivery URLs at 31.214.157.49 and a C2 at 178.215.224.252/v10/ukyh.php) on 18 November 2024, but described the payload only as "suspected" Lucky Volunteer and the actor link only as an assessed "overlap with activity attributed to UAC-0050." This is analyst attribution based on infrastructure/TTP overlap, not a CERT-UA-confirmed or court-adjudicated finding for this specific sub-campaign.
No named victim organizations, breach disclosures, or financial-loss figures tied to this exact ClickFix/Lucky Volunteer chain have been published. Separately and around the same week, CERT-UA issued a genuine government advisory (CERT-UA#11689, 25 October 2024) describing a closely related fake-reCAPTCHA/PowerShell-clipboard technique used against Ukrainian local government bodies (a "Table Replacement" email lure with a fake Google Sheets link, leading to an SSH tunnel, Metasploit, and browser-credential theft), but CERT-UA attributed that specific campaign to a different actor, UAC-0001 (APT28/Fancy Bear/GRU), with only "medium confidence," not to UAC-0050. The two campaigns are best understood as parallel adoptions of the same emerging ClickFix/fake-CAPTCHA technique by different Russia-linked clusters against Ukraine in the same October 2024 window, not a single incident with one dedicated CERT-UA advisory naming UAC-0050 and "Lucky Volunteer" together.
This case is a clear example of an emerging-vector technique (ClickFix / fake-CAPTCHA "verify you are human" social engineering) migrating from commodity cybercrime toolkits into use by suspected nation-state-adjacent espionage actors within weeks of the technique's public release: the "reCAPTCHA Phish" toolkit went from a GitHub proof-of-concept (mid-September 2024) to apparent adoption in an actor-overlapping-with-UAC-0050 espionage campaign (31 October 2024) in under seven weeks.
It also illustrates why ClickFix defeats a large share of conventional anti-phishing training: there is no malicious link to hover over and no attachment to "not open" in the traditional sense: the entire compromise depends on convincing the victim to personally execute a command, weaponizing the most trusted micro-interaction on the modern web (the CAPTCHA) as the delivery mechanism.
For an education site, it is also a useful case study in attribution discipline: multiple Russia-linked clusters (UAC-0050 per Proofpoint's assessment, UAC-0001/APT28 per CERT-UA's confirmed advisory) converged on the same technique against the same country in the same month, and the record shows how easily distinct campaigns and confidence levels get merged in secondary reporting.
Treat any "CAPTCHA" that asks you to open Windows Run/PowerShell/Terminal and paste a command as malicious; genuine CAPTCHAs never require this. Technical controls: block/alert on HTML-smuggled (compressed HTML) email attachments; restrict PowerShell execution policy and log ScriptBlock/clipboard-invoked commands; alert on BITS transfer abuse (bitsadmin/Start-BitsTransfer) as a delivery mechanism; monitor for mshta.exe and unsigned script execution from Startup/Run-dialog context; disable or tightly scope end-user PowerShell access via AppLocker/WDAC or Just Enough Administration; user awareness training that explicitly names ClickFix as a category distinct from classic phishing (no malicious link or attachment needs to be opened; the victim is walked through infecting their own machine).
Social Engineering Examples. “UAC-0050 ClickFix Fake-reCAPTCHA Campaign Deploys 'Lucky Volunteer' Infostealer Against Ukrainian Organizations”. Accessed 19 September 2026. https://socialengineeringexamples.com/uac-0050-clickfix-recaptcha-lucky-volunteer-2024
UAC-0050 is documented by CERT-UA as a Russia-linked cluster that has run over a dozen operations against Ukrainian organizations in a single two-month window; selecting Ukrainian-language, document-sharing themed targets for this wave was consistent with that established targeting pattern rather than a bespoke research effort against named individuals.
Broad organizational targeting based on nationality and sector is very hard to prevent at the recipient-selection stage; the realistic control sits downstream at the email gateway and user-behavior layers, since defenders cannot stop an actor from choosing Ukrainian organizations as a target class.
rather than building a custom fake-CAPTCHA page from scratch, the operators are assessed to have adopted the open-source 'reCAPTCHA Phish' ClickFix toolkit that had been published to GitHub in mid-September 2024 for 'educational purposes,' consistent with how Proofpoint observed multiple unrelated threat clusters begin abusing the same public toolkit within days of its release.
Threat-intel teams that track public phishing-kit repositories and vendor threat briefs (like Proofpoint's) can build detections for a newly released toolkit within the same days-to-weeks window that threat actors adopt it, closing the gap between kit publication and defensive coverage.
the operators stood up dedicated delivery and command-and-control hosting (the IPs Proofpoint later published as IOCs) shortly before the campaign, typical of how ClickFix operators stage short-lived infrastructure per wave to limit exposure before takedown.
Once IOCs are published (as Proofpoint did for the delivery and C2 IPs), rapid ingestion into network/DNS blocklists and threat-intel platforms prevents reuse of the same infrastructure against other targets, though it does not stop the initial wave before disclosure.
the operators obtained or had access to the rarely-seen 'Lucky Volunteer' infostealer, previously observed only once, dropped via AresLoader in a March 2023 TA579 campaign, suggesting a supplier/loader relationship or shared tooling access rather than an in-house-built stealer.
Endpoint detection tuned to known infostealer and loader families, plus sharing of rare-payload indicators across the security community, raises the cost of reusing an already-identified stealer like Lucky Volunteer in future campaigns.
a Ukrainian-language phishing email purporting to share a document or requested information was sent with a compressed HTML attachment, using HTML smuggling to slip the payload past attachment scanners that inspect for known-malicious file types.
Email security gateways should block or flag HTML-smuggled (compressed/encoded HTML) attachments specifically, since this delivery method is designed to evade conventional signature-based attachment scanning.
opening the attachment rendered a spoofed 'Verify You Are Human' reCAPTCHA page (in English, despite the Ukrainian-language email) designed to exploit users' trained habit of clicking through CAPTCHA checks without scrutiny.
User-awareness training that explicitly names fake-CAPTCHA/ClickFix pages as a distinct phishing category, and that teaches 'a real CAPTCHA never asks you to open Run or a terminal,' directly targets the psychological trust being exploited at this stage.
the page instructed the victim to paste a provided string into the Windows Run dialog or a PowerShell terminal and press Enter, converting the classic 'don't click the link/attachment' defense into a dead end since the victim, not the attacker, performs the final malicious action.
Technical controls that restrict or log end-user PowerShell and Run-dialog activity, such as AppLocker/WDAC application control, Just Enough Administration, and ScriptBlock/clipboard logging, can block or flag the moment the victim is walked into self-executing the payload.
the pasted command triggered a chained PowerShell sequence using a BITS transfer to download and run the suspected Lucky Volunteer infostealer, which then contacted a hard-coded C2 server to exfiltrate browser and credential data, completing the credential-theft and intelligence-collection objective.
Network monitoring for BITS-transfer abuse (bitsadmin/Start-BitsTransfer) and for outbound connections to newly observed or reputation-flagged C2 infrastructure gives defenders a last chance to interrupt payload download and data exfiltration before objective completion.
Browse by what this case has in common with others in the library.
Fraudsters built a fake WhatsApp profile of WPP CEO Mark Read and staged a Microsoft Teams call using an AI…
Vidoc Security Lab, a Polish-founded, US-headquartered cybersecurity startup.
Russian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
A blogger paid $89.95 to an online data broker (CellTolls.com) to buy retired Gen. Wesley Clark's cell-phone call log obtained…
A Chinese national talked her way past three layers of Mar-a-Lago's Secret Service and club-staff checkpoints using a false pool…
Russia's Sandworm Team used spear-phishing emails with malicious Office macro attachments to plant BlackEnergy3 malware inside three Ukrainian power.
A Pennsylvania shredding-business owner's 2010 qui tam suit alleged that Shred-It, Iron Mountain.
Fraudsters plastered fake QR-code stickers over genuine PayByPhone parking codes at UK council car parks in Cheltenham, Swindon and Somerset.
The FTC's first major consumer alert on QR-code scams (Dec 6, 2023) warned of fake QR stickers on parking meters…
A Singaporean businessman transferred at least S$4.9 million after WhatsApp and email lures citing the Strait of Hormuz crisis drew…
An Atlantic City woman posed as a life-insurance/retirement-benefit representative on burner-phone calls to recently widowed elderly victims.
A nation-state cyberweapon crossed an air gap into Iran's Natanz nuclear facility on infected USB drives carried in by trusted…
Russia's Sandworm Team used spear-phishing emails with malicious Office macro attachments to plant BlackEnergy3 malware inside three Ukrainian power.
Russian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
Google's GTIG and Ukraine's CERT-UA documented PROMPTSTEAL (aka LAMEHUG).
Russia's Sandworm Team used spear-phishing emails with malicious Office macro attachments to plant BlackEnergy3 malware inside three Ukrainian power.
A single spear-phishing email titled "2011 Recruitment Plan," with a booby-trapped Excel attachment.
Chinese state-linked hackers used spear-phishing links and an unpatched Internet Explorer zero-day to breach Google, Adobe.
In late December 2012, attackers rigged the Council on Foreign Relations website to silently exploit an Internet Explorer zero-day and…
Lazarus-linked operators built polished fake job-interview sites impersonating Coinbase, Kraken, Circle and other crypto firms.
A nation-state cyberweapon crossed an air gap into Iran's Natanz nuclear facility on infected USB drives carried in by trusted…
Social Engineering Examples