The State Special Communications Service detected the spread of a virus disguised as the "I'm Not a Robot" verification
CERT-UA has issued a warning regarding a sophisticated malware campaign that uses fake 'I'm not a robot' verification prompts to trick users. By instructing victims to execute commands via PowerShell or the command prompt, attackers install browser extensions designed to steal sensitive personal data.
Why it matters
This highlights a growing trend in social engineering where attackers exploit user trust in common web security features to bypass traditional defenses.
--> CERT-UA , the national response team for cyber incidents, cyberattacks, and cyber threats operating under the State Special Communications Service, has detected a new large-scale campaign to spread malware .
In September 2026 alone, CERT-UA specialists recorded over 100 compromised websites . Hackers injected malicious JavaScript code into the compromised sites.
A distinctive feature of this campaign is that the attackers use legitimate and well-known websites . They compromise the sites and make minor changes that can go unnoticed by owners and visitors for a long time.
Once a user visits a compromised site, they are shown a fake Cloudflare verification page .
Under the guise of a standard “I’m not a robot” verification, the user is prompted to copy and execute a specific command. To do this, the attackers may ask the user to use the Win+R shortcut , the command prompt, or PowerShell .
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in