Key Takeaways
- Ukraine’s CERT says Sandworm, a GRU-linked hacking unit, is now using ClickFix in attacks against sensitive organizations.
- The lure uses a fake CAPTCHA to get targets to copy and paste a command into a terminal, which can lead to malware installation or data theft.
- The campaign has already involved compromised websites and at least one confirmed network compromise tied to FreakyPoll malware.
What happened
Ukraine’s CERT warned that Sandworm, one of the Russian government’s more elite hacking groups, has adopted ClickFix in attacks against sensitive organizations in Ukraine. ClickFix is a social-engineering technique that became more visible over the past year as financially motivated criminals used it to trick victims into helping deliver malicious code.
In the campaign described by Ukrainian authorities, attackers controlled websites that showed visitors a fake CAPTCHA. Instead of simply checking a box or selecting images, the prompt told the user to copy a jumble of text and paste it into a terminal. That text contained scripts designed to carry out malicious actions once entered.
According to the advisory, Ukrainian investigators found 10 compromised websites displaying a PowerShell command as part of the fake CAPTCHA flow. Once a target ran the script, it could install malicious Visual Basic scripts and other tools associated with Sandworm’s operations.
The reported chain of activity began with reconnaissance. The first malware to run was used to gather information from the infected device. If the machine appeared important, follow-on malware could then be deployed to backdoor the system.
The advisory also noted malware identifiers tied to the campaign, including FreakyPoll, GHETTOVIBE, and SCOUTCURL. One translated description said GHETTOVIBE could be used to load and save a VBS file in the Startup directory, while SCOUTCURL could collect and exfiltrate basic system information, programs, files, and browser data.
The campaign reportedly started in the spring and continued through the summer. Ukrainian authorities said it resulted in the network compromise of at least one organization after a connected device was found infected by FreakyPoll.
Why it matters
ClickFix matters because it lowers the technical bar for getting an initial foothold. Instead of relying only on software exploits, the attacker pushes part of the infection chain onto the user. That makes the tactic effective even when a target’s systems are reasonably patched, because the user is persuaded to execute the attack manually.
The new detail here is not that ClickFix exists, but that a state-linked actor is using it. That suggests the technique has moved beyond opportunistic abuse and into higher-end intrusion playbooks. For defenders, that broadens the threat model: a lure that can look crude or unsophisticated may now be part of a campaign run by a more capable adversary.
The method is also flexible. The source material shows a fake CAPTCHA used as the social-engineering wrapper, but the core idea is the same: convince a person to paste attacker-controlled instructions into a shell. Once that happens, the attacker can stage reconnaissance first and then deliver more specific malware based on the device’s value.
That progression is what makes the technique particularly concerning. It does not merely attempt to infect a device; it tries to identify which infections are worth deepening. In other words, the lure is being used as a filter, not just a trigger.
What to watch
Security teams should watch for websites that present unusual CAPTCHA flows and then instruct visitors to copy commands into a terminal or run scripts locally. A real CAPTCHA should not require command execution.
Defenders should also pay attention to user-execution indicators, especially when a web prompt leads into PowerShell, VBS, or startup-folder persistence behavior. The source material suggests that the campaign uses those steps to move from initial access to reconnaissance and then to deeper compromise.
Because the campaign reportedly uses compromised websites, monitoring for unexpected changes in trusted sites is important as well. A legitimate-looking domain can still be turned into a delivery point for a malicious prompt.
The broader trend to watch is whether other sophisticated actors adopt the same approach. If a technique once associated with lower-end crime keeps showing up in advanced campaigns, it is likely because it offers a practical way to bypass purely technical defenses by exploiting human behavior instead.
