Over 100 Ukrainian Websites Compromised by Malware Scheme

• •Over 100 Ukrainian websites compromised with malware disguised as CAPTCHA.
• •Users are tricked into executing commands that install harmful software.
• •The attacks specifically target Windows users from search engines.

The State Special Communications Service of Ukraine reported over 100 hacked websites that display a fake 'I am not a robot' verification page. This scheme, attributed to the group UAC-0277, tricks users into executing a command that installs malware on their Windows systems. The malicious JavaScript code embedded in these sites prompts users to run commands via Win+R, CMD, or PowerShell, leading to the installation of harmful software. The attacks target Windows users arriving from search engines like Google and DuckDuckGo, showing the fake verification page no more than twice every 12 hours. CERT-UA emphasizes that legitimate CAPTCHA or Cloudflare checks never require users to execute system commands. The malware can steal sensitive information and may allow remote control of infected devices. Users are advised to close any suspicious pages immediately.