One of the Russian government’s most elite hacking groups has adopted an attack, known as Clickfix, to compromise devices belonging to sensitive organizations in Ukraine, the latter country’s CERT center is warning.
Clickfix has emerged as an effective attack technique that attackers, primarily financially motivated criminals, began using in the last year or so. Websites under the control of the attackers display a CAPTCHA that requires the visitor to copy a jumble of text and paste it into the terminal. The text contains scripts that, once entered, perform malicious actions, typically by installing malware or exfiltrating sensitive data. Ukraine’s CERT said Wednesday that Sandworm, an advanced hacking unit inside the GRU, Russia’s military intelligence arm, is now using the technique.
“GhettoVibe,” “ScoutCurl,” and many more
The Clickfix attacks began in the spring and have continued through the summer. The campaign has resulted in the network compromise of at least one organization when a connected device was found to be infected by FreakyPoll, the name of one of Sandworm’s custom malware packages. Ukrainian authorities discovered 10 compromised websites that displayed a PowerShell command as part of a fake CAPTCHA that said it had to be passed to ensure a real human was behind the visiting device’s keyboard.
Once the user entered the script, it could install malicious Visual Basic scripts and other malicious wares that went on to install a variety of Sandworm malware. Typically, the first malware to run was a reconnaissance program that gathered information from the infected device. Machines deemed important would then receive follow-on malware that backdoored the system.
“The command, as an example, could be intended to load and save a VBS file in the Startup directory,” a translated version of Tuesday’s advisory stated. “One of the variants of such a program was called GHETTOVIBE. At the next stage, in order to determine the importance of the cyberattack object, the SCOUTCURL software tool can be loaded onto the attacked computer, which is a PowerShell script that performs basic reconnaissance by collecting and exfiltrating information about the computer: basic characteristics, programs, files, Internet browser data, etc.”
Facts Only
* Russian government hacking groups adopted an attack known as Clickfix.
* The attack targeted devices belonging to sensitive organizations in Ukraine.
* Ukraine’s CERT center issued a warning regarding this activity.
* Clickfix involves websites displaying a CAPTCHA requiring text input into the terminal.
* The input text contains scripts that perform malicious actions, such as installing malware or exfiltrating data.
* Sandworm, an advanced hacking unit inside the GRU, is using the Clickfix technique.
* Infections occurred when devices were exposed to FreakyPoll malware.
* Ten compromised websites were discovered displaying PowerShell commands within fake CAPTCHAs.
* Entered scripts could install malicious Visual Basic scripts and Sandworm malware.
* Reconnaissance tools like SCOUTCURL were used to gather information about infected machines.
Executive Summary
Russian hacking groups are utilizing an attack method called Clickfix to compromise devices belonging to sensitive organizations in Ukraine, as warned by the country's CERT center. This technique involves attackers deploying websites that present a CAPTCHA requiring users to input text into a terminal. This text contains scripts designed to execute malicious actions, such as installing malware or exfiltrating data. Sandworm, an advanced hacking unit within Russia’s GRU, is now employing this technique.
The Clickfix campaign began in the spring and continued through the summer. The activity resulted in network compromise of at least one organization when a connected device was infected by FreakyPoll malware. Ukrainian authorities identified ten compromised websites that featured PowerShell commands embedded in fake CAPTCHAs designed to verify human interaction. Once users entered the script, malicious Visual Basic scripts and other malware were installed. Reconnaissance programs, such as SCOUTCURL, were often used first to gather information about the infected device before follow-on malware was deployed to establish backdoors.
Full Take
The deployment of Clickfix represents a shift toward leveraging seemingly benign user interaction as an initial vector for deep system compromise, moving beyond traditional network intrusion methods. The pattern observed is the co-option of established interactive web technologies (CAPTCHA) into an infection mechanism, which leverages user compliance to execute code execution. This tactic shifts the security perimeter from technical defenses alone to behavioral manipulation—making the user the unwitting component in the attack chain. The progression from initial reconnaissance (SCOUTCURL) to payload delivery (VBS files and malware) shows a structured, multi-stage compromise designed for persistent access rather than a single breach.
The implication here is that defense strategies must account for the potential compromise of end-user context, not just network boundaries. If sophisticated state actors can embed malicious payloads within expected interactive prompts, it suggests an erosion of trust in operating system processes themselves. The focus moves from perimeter defense to understanding how systems process input and execute commands, necessitating a reevaluation of endpoint security and user training models to account for these novel social engineering-adjacent exploitation techniques.
Bridge Questions: How can defensive architectures be designed to verify the integrity of user-supplied data within interactive contexts? What cognitive defenses are necessary when expecting system prompts to enforce security protocols? If state actors consistently adapt initial access methods via perceived benign interfaces, what does this imply about the future viability of traditional cryptographic and network segmentation as primary defenses?
Sentinel — Human
The text appears to be a factual report detailing cyberattack methodology attributed to specific state actors and malware, strongly suggesting human-sourced investigative reporting.