A Ukrainian-language "shared document" phishing wave used a fake reCAPTCHA "verify you are human" ClickFix page to trick victims into pasting and running PowerShell themselves, deploying a rarely-seen infostealer Proofpoint dubbed suspected "Lucky Volunteer" in activity assessed to overlap with the Russia-linked espionage actor UAC-0050.
Social Engineering Examples·5 sources
On 31 October 2024, Proofpoint researchers identified a Ukrainian-language phishing campaign, later assessed to overlap with the Russia-linked threat cluster UAC-0050, targeting organizations in Ukraine. Emails purported to share documents or requested information and carried compressed HTML attachments. Opening the attachment rendered a fake webpage using the "reCAPTCHA Phish" ClickFix technique. The page displayed a "Verify You Are Human" CAPTCHA-style challenge that instructed the victim to copy and paste a provided PowerShell script. The landing page was in English although the originating email and attachment names were in Ukrainian. Victims who followed the instructions triggered PowerShell activity that used BITS to download and execute a payload Proofpoint assessed as suspected Lucky Volunteer, a rarely observed infostealer. Proofpoint catalogued this wave in its 18 November 2024 threat brief.
(1) Lure: a Ukrainian-language email claiming to share a document or requested information. (2) Delivery: the email carried a compressed HTML attachment. (3) Fake verification: opening the attachment rendered a webpage using the open-source "reCAPTCHA Phish" ClickFix toolkit, with an English-language landing page despite the Ukrainian-language email and attachment names. (4) Self-execution: the page told the victim to verify they were human by copying and pasting a provided PowerShell script. (5) Chain: the pasted command ran PowerShell activity using BITS to fetch and execute a payload Proofpoint assessed as suspected Lucky Volunteer.
Lure: a routine-sounding Ukrainian business email about a shared document or requested information. Tell: the page asked the user to copy and paste a PowerShell script as part of the purported verification, and the Ukrainian-language email and attachment names did not match the English-language landing page.
Proofpoint publicly documented the campaign with full indicators of compromise (delivery URLs at 31.214.157.49 and a C2 at 178.215.224.252/v10/ukyh.php) on 18 November 2024, but described the payload only as "suspected" Lucky Volunteer and the actor link only as an assessed "overlap with activity attributed to UAC-0050." This is analyst attribution based on infrastructure/TTP overlap, not a CERT-UA-confirmed or court-adjudicated finding for this specific sub-campaign. No named victim organizations, breach disclosures, or financial-loss figures tied to this exact ClickFix/Lucky Volunteer chain have been published. Separately and around the same week, CERT-UA issued a genuine government advisory (CERT-UA#11689, 25 October 2024) describing a closely related fake-reCAPTCHA/PowerShell-clipboard technique used against Ukrainian local government bodies (a "Table Replacement" email lure with a fake Google Sheets link, leading to an SSH tunnel, Metasploit, and browser-credential theft), but CERT-UA attributed that specific campaign to a different actor, UAC-0001 (APT28/Fancy Bear/GRU), with only "medium confidence," not to UAC-0050. The two campaigns are best understood as parallel adoptions of the same emerging ClickFix/fake-CAPTCHA technique by different Russia-linked clusters against Ukraine in the same October 2024 window, not a single incident with one dedicated CERT-UA advisory naming UAC-0050 and "Lucky Volunteer" together.
This case illustrates the use of a fake-CAPTCHA ClickFix flow in an activity cluster that Proofpoint assessed as overlapping with UAC-0050. The campaign used a document-themed email, a compressed HTML attachment, a verification page, and user execution of a PowerShell command. The record distinguishes this assessment from the separate CERT-UA advisory attributing a related technique to UAC-0001.
Treat a purported CAPTCHA that asks the user to copy and paste a PowerShell command as suspicious. Relevant defensive measures include reviewing compressed HTML attachments, restricting and logging PowerShell, monitoring BITS activity, and training users that verification pages should not require command execution.
Social Engineering Examples. “UAC-0050 ClickFix Fake-reCAPTCHA Campaign Deploys 'Lucky Volunteer' Infostealer Against Ukrainian Organizations”. Accessed 3 November 2026. https://socialengineeringexamples.com/uac-0050-clickfix-recaptcha-lucky-volunteer-2024
UAC-0050 is documented by CERT-UA as a Russia-linked cluster that has run over a dozen operations against Ukrainian organizations in a single two-month window; selecting Ukrainian-language, document-sharing themed targets for this wave was consistent with that established targeting pattern rather than a bespoke research effort against named individuals.
Broad organizational targeting based on nationality and sector is very hard to prevent at the recipient-selection stage; the realistic control sits downstream at the email gateway and user-behavior layers, since defenders cannot stop an actor from choosing Ukrainian organizations as a target class.
rather than building a custom fake-CAPTCHA page from scratch, the operators are assessed to have adopted the open-source 'reCAPTCHA Phish' ClickFix toolkit that had been published to GitHub in mid-September 2024 for 'educational purposes,' consistent with how Proofpoint observed multiple unrelated threat clusters begin abusing the same public toolkit within days of its release.
Threat-intel teams that track public phishing-kit repositories and vendor threat briefs (like Proofpoint's) can build detections for a newly released toolkit within the same days-to-weeks window that threat actors adopt it, closing the gap between kit publication and defensive coverage.
the operators stood up dedicated delivery and command-and-control hosting (the IPs Proofpoint later published as IOCs) shortly before the campaign, typical of how ClickFix operators stage short-lived infrastructure per wave to limit exposure before takedown.
Once IOCs are published (as Proofpoint did for the delivery and C2 IPs), rapid ingestion into network/DNS blocklists and threat-intel platforms prevents reuse of the same infrastructure against other targets, though it does not stop the initial wave before disclosure.
the operators obtained or had access to the rarely-seen 'Lucky Volunteer' infostealer, previously observed only once, dropped via AresLoader in a March 2023 TA579 campaign, suggesting a supplier/loader relationship or shared tooling access rather than an in-house-built stealer.
Endpoint detection tuned to known infostealer and loader families, plus sharing of rare-payload indicators across the security community, raises the cost of reusing an already-identified stealer like Lucky Volunteer in future campaigns.
a Ukrainian-language phishing email purporting to share a document or requested information was sent with a compressed HTML attachment.
Email security gateways should block or flag HTML-smuggled (compressed/encoded HTML) attachments specifically, since this delivery method is designed to evade conventional signature-based attachment scanning.
opening the attachment rendered a spoofed 'Verify You Are Human' reCAPTCHA page (in English, despite the Ukrainian-language email) designed to exploit users' trained habit of clicking through CAPTCHA checks without scrutiny.
User-awareness training that explicitly names fake-CAPTCHA/ClickFix pages as a distinct phishing category, and that teaches 'a real CAPTCHA never asks you to open Run or a terminal,' directly targets the psychological trust being exploited at this stage.
the page instructed the victim to copy and paste a provided PowerShell script as instructed, converting the classic 'don't click the link/attachment' defense into a dead end since the victim, not the attacker, performs the final malicious action.
Network monitoring for BITS-transfer abuse (bitsadmin/Start-BitsTransfer) and for outbound connections to newly observed or reputation-flagged C2 infrastructure gives defenders a last chance to interrupt payload download and data exfiltration before objective completion.
Browse by what this case has in common with others in the library.
eSentire's Threat Response Unit says it shut down 10 attacks on six unnamed law firms across January and February 2023,…
A victim searching for the AnyDesk remote-access tool hit a typosquatted site with a fake Cloudflare Turnstile that, instead of…
Gootloader went quiet in the spring of 2025, the tracking researcher telling BleepingComputer his abuse reports caused the operation to…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
An attack attributed to Russia's Sandworm Team used compromised credentials to remotely open substation breakers at three Ukrainian utilities and…
Impersonators posing as two Philadelphia school vendors asked to switch from cheque to ACH and diverted nearly $700,000 in 2024.…
A fake email posing as DTC gave JE Cleantech false wire instructions for its 2026 dividend, diverting US$794,934 and delaying…
Three separate congressional watchdog engagements, not one campaign. In 2000, GAO agents carrying counterfeit badges declared themselves armed officers and…
Criminals posing as a vendor redirected $4.92M in North Dakota school building-fund payments in 2026. The FBI seized $4.86M. How…
A compromised Constant Contact mass-mailing account let Russia-linked Nobelium (APT29) send USAID-spoofed phishing emails that funneled roughly 3,000-7,000 accounts across…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
Russian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
An attack attributed to Russia's Sandworm Team used compromised credentials to remotely open substation breakers at three Ukrainian utilities and…
A fake 'reactivate your MFA' email with a QR code targeted a US MSP employee in 2023, routing through a…
Fraudsters spoofed Barclays' real phone number and hold music, posed as the bank's fraud team in a two-caller vishing script,…
Orion S.A. lost about $60M in 2024 when an employee was tricked into wiring money to criminals. What Orion confirmed,…
Attackers hijacked a staff email account and used fake solar-panel invoices to trick the US charity into wiring $997,400 to…
A small Columbus, Ohio public materials manufacturer disclosed in a February 2026 SEC 8-K that it lost $898,325 to an…
Hours before Maharashtra's 2024 assembly election polling, BJP-amplified audio clips purporting to catch two opposition leaders discussing a bitcoin-funded election…
Social Engineering Examples