UAC-0050 ClickFix Fake-reCAPTCHA Campaign Deploys 'Lucky Volunteer' Infostealer Against Ukrainian Organizations

What Happened

On 31 October 2024, Proofpoint researchers identified a Ukrainian-language phishing campaign, later assessed to overlap with the Russia-linked threat cluster UAC-0050, targeting organizations in Ukraine. Emails purported to share documents or requested information and carried compressed HTML attachments, a technique (HTML smuggling) that helps the malicious payload evade attachment scanning. Opening the attachment rendered a fake webpage using the "reCAPTCHA Phish" ClickFix technique: an open-source toolkit published to GitHub in mid-September 2024 "for educational purposes" that Proofpoint began seeing abused in the wild within days of release, itself modeled on a technique threat actors had already been running against video-streaming sites since August 2024. The page displayed a "Verify You Are Human" CAPTCHA-style challenge that, instead of a real bot check, instructed the victim to copy a provided string and paste it into the Windows Run dialog or a PowerShell terminal and press Enter. Notably, the landing page itself was in English even though the originating email and attachment names were in Ukrainian. Victims who followed the instructions triggered a first PowerShell command that launched a second PowerShell script using a BITS transfer to download and execute a payload Proofpoint assessed as "suspected Lucky Volunteer," a rarely observed infostealer previously seen only once before, in a March 2023 TA579 campaign where it was dropped by AresLoader. This was one of several ClickFix/fake-CAPTCHA campaigns Proofpoint catalogued in its 18 November 2024 threat brief (alongside a GitHub-notification campaign delivering Lumma Stealer to 300+ organizations, a Swiss Ricardo-impersonation campaign, and a NetSupport RAT campaign), but the UAC-0050 wave was distinguished as the only one involving a suspected nation-state espionage actor rather than a purely financially-motivated cybercrime cluster.

How the Attack Worked

(1) Lure: a Ukrainian-language email claiming to share a document or requested information. (2) Delivery: the email carried a compressed HTML attachment (HTML smuggling) rather than a link or executable, which evades many gateway filters. (3) Fake verification: opening the attachment rendered a webpage using the open-source "reCAPTCHA Phish" ClickFix toolkit (released on GitHub mid-September 2024 "for educational purposes" and adopted by multiple threat clusters within days), notably the landing page itself was in English despite the Ukrainian-language email and attachment names. (4) Self-execution: the page told the victim to "verify you are human" by copying a provided string and pasting it into the Windows Run dialog or a PowerShell/terminal window and pressing Enter. A genuine CAPTCHA never asks this. (5) Chain: the pasted command ran a first PowerShell stage that invoked a second PowerShell script using BITS transfer (a living-off-the-land download mechanism) to fetch and execute a payload Proofpoint assessed as the rarely-seen "Lucky Volunteer" infostealer (previously seen only once before, dropped by AresLoader in a March 2023 TA579 campaign), which then reached out to a hard-coded C2. No exploit or unpatched vulnerability was used anywhere in the chain: every step required the victim's own hands-on-keyboard action.

The Lure & the Tell

Lure: a routine-sounding Ukrainian business email about a shared document or requested information, the kind of message an employee expects and opens without hesitation. Tell: (1) a "CAPTCHA" that asks you to press Win+R (or open a terminal), paste, and hit Enter is never a real CAPTCHA; legitimate bot checks only require a checkbox click or image selection, they never touch your clipboard or ask for keyboard shortcuts; (2) the mismatch between a Ukrainian-language email/attachment and an English-language "verification" landing page was itself an inconsistency; (3) any unsolicited instruction that walks you through "fixing an error" by running a command you can't read in full (the Run dialog truncates long pasted strings) is a red flag used across ClickFix variants specifically to hide the malicious payload in plain sight.

Outcome

Proofpoint publicly documented the campaign with full indicators of compromise (delivery URLs at 31.214.157.49 and a C2 at 178.215.224.252/v10/ukyh.php) on 18 November 2024, but described the payload only as "suspected" Lucky Volunteer and the actor link only as an assessed "overlap with activity attributed to UAC-0050." This is analyst attribution based on infrastructure/TTP overlap, not a CERT-UA-confirmed or court-adjudicated finding for this specific sub-campaign. No named victim organizations, breach disclosures, or financial-loss figures tied to this exact ClickFix/Lucky Volunteer chain have been published. Separately and around the same week, CERT-UA issued a genuine government advisory (CERT-UA#11689, 25 October 2024) describing a closely related fake-reCAPTCHA/PowerShell-clipboard technique used against Ukrainian local government bodies (a "Table Replacement" email lure with a fake Google Sheets link, leading to an SSH tunnel, Metasploit, and browser-credential theft), but CERT-UA attributed that specific campaign to a different actor, UAC-0001 (APT28/Fancy Bear/GRU), with only "medium confidence," not to UAC-0050. The two campaigns are best understood as parallel adoptions of the same emerging ClickFix/fake-CAPTCHA technique by different Russia-linked clusters against Ukraine in the same October 2024 window, not a single incident with one dedicated CERT-UA advisory naming UAC-0050 and "Lucky Volunteer" together.

Why It Matters

This case is a clear example of an emerging-vector technique (ClickFix / fake-CAPTCHA "verify you are human" social engineering) migrating from commodity cybercrime toolkits into use by suspected nation-state-adjacent espionage actors within weeks of the technique's public release: the "reCAPTCHA Phish" toolkit went from a GitHub proof-of-concept (mid-September 2024) to apparent adoption in an actor-overlapping-with-UAC-0050 espionage campaign (31 October 2024) in under seven weeks. It also illustrates why ClickFix defeats a large share of conventional anti-phishing training: there is no malicious link to hover over and no attachment to "not open" in the traditional sense: the entire compromise depends on convincing the victim to personally execute a command, weaponizing the most trusted micro-interaction on the modern web (the CAPTCHA) as the delivery mechanism. For an education site, it is also a useful case study in attribution discipline: multiple Russia-linked clusters (UAC-0050 per Proofpoint's assessment, UAC-0001/APT28 per CERT-UA's confirmed advisory) converged on the same technique against the same country in the same month, and the record shows how easily distinct campaigns and confidence levels get merged in secondary reporting.

Defenses

Treat any "CAPTCHA" that asks you to open Windows Run/PowerShell/Terminal and paste a command as malicious; genuine CAPTCHAs never require this. Technical controls: block/alert on HTML-smuggled (compressed HTML) email attachments; restrict PowerShell execution policy and log ScriptBlock/clipboard-invoked commands; alert on BITS transfer abuse (bitsadmin/Start-BitsTransfer) as a delivery mechanism; monitor for mshta.exe and unsigned script execution from Startup/Run-dialog context; disable or tightly scope end-user PowerShell access via AppLocker/WDAC or Just Enough Administration; user awareness training that explicitly names ClickFix as a category distinct from classic phishing (no malicious link or attachment needs to be opened; the victim is walked through infecting their own machine).