{"id":63743,"date":"2026-07-17T13:42:27","date_gmt":"2026-07-17T17:42:27","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=63743"},"modified":"2026-07-17T13:42:27","modified_gmt":"2026-07-17T17:42:27","slug":"sandworm-clickfix-ukraine","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/sandworm-clickfix-ukraine\/","title":{"rendered":"Sandworm adopts Clickfix to infect Ukrainian devices"},"content":{"rendered":"

The Russian military intelligence unit known as Sandworm has adopted the Clickfix social engineering<\/a> technique to compromise networks of sensitive Ukrainian organizations, according to a warning from Ukraine’s Computer Emergency Response<\/a> Team (CERT-UA<\/a>). The shift marks a notable escalation: Clickfix, previously a tool of financially motivated cybercriminals, is now being weaponized by one of the world’s most dangerous state-sponsored hacking groups.<\/p>\n

What Is Clickfix?<\/h2>\n

Clickfix is an attack method that tricks users into executing malicious commands through a fake CAPTCHA challenge. Victims visiting a compromised or attacker-controlled website are presented with a CAPTCHA that requires them to copy a jumble of text and paste it into a terminal window. That text contains PowerShell or other scripts that, once run, install malware or exfiltrate sensitive data. The technique has surged in popularity over the last year because it bypasses traditional web filters and relies on the user’s own trust in CAPTCHA as a legitimate security measure.<\/p>\n

Sandworm’s Clickfix Campaign Targets Ukraine<\/h2>\n

CERT-UA reported Wednesday<\/a> that Sandworm\u2014operating under the GRU, Russia’s military intelligence agency\u2014began deploying Clickfix attacks in spring 2025 and has continued through the summer. Investigators discovered at least ten compromised websites that hosted fake CAPTCHA pages instructing visitors to run PowerShell commands. One of the earliest malware payloads identified in the campaign is a reconnaissance script named GHETTOVIBE, which collects system information, installed programs, files, and browser data. Once the threat is assessed, a second-stage tool called SCOUTCURL\u2014a PowerShell-based reconnaissance and exfiltration script\u2014transmits the stolen data back to the attackers.<\/p>\n

Machines deemed valuable are then loaded with more destructive follow-on malware, including FreakyPoll, a custom Sandworm backdoor. The advisory notes that at least one organization suffered a full network compromise after an infected device was connected to its internal systems.<\/p>\n

The attack chain typically works like this:<\/p>\n