Ukraine’s computer emergency response team, CERT-UA, has warned<\/a> that Russian hackers are using fake CAPTCHA checks to trick people into compromising their own PCs.<\/p>\n The Kremlin-backed Sandworm hacking group is reportedly<\/a> leveraging fake CAPTCHA checks on compromised websites that persuade users to execute a PowerShell command on their computers – tricking them into running malicious code.<\/p>\n CERT-UA has attributed the attacks, which have surged this spring and summer against Ukrainian targets, to UAC-0145 – a branch of Sandworm, the hacking unit known for some of Russia’s most destructive cyber attacks in the past 10+ years, including ones against Ukraine’s power grid.<\/p>\n The latest attacks begin when a user visits a compromised webpage, where they’re greeted by a fake CAPTCHA claiming they need to complete an extra step to prove that they are human.<\/p>\n But unlike normal CAPTCHAs it is not about picking out the traffic lights or ticking a box. Instead, the fake CAPTCHA instructs the user to copy and paste a PowerShell command into their Windows<\/a> computer.<\/p>\n Of course, it’s not worded quite like that.<\/p>\n figurefigure<\/p>\n The instructions tell the user to press a key sequence that opens the Windows Run dialog, pastes the contents of the clipboard, and hits Enter \u2014 all without the victim realising what they have just unleashed.<\/p>\n Because what they’ve just executed could:<\/p>\n A genuine CAPTCHA will never ask you to:<\/p>\n The downloaded code run on targeted computers runs a reconnaissance tool called ScoutCurl that collects information about the infected computer. This includes details about how the system is set up, what software is installed, files that are present, and browser data – all of which helps attackers determine whether the target is worth compromising further.<\/p>\n At least ten websites are estimated to have been compromised as part of the campaign since the beginning of June.<\/p>\n ClickFix attacks like this are not new, and we have written about the threat many<\/a> times<\/a> in past<\/a> articles<\/a>.<\/p>\n The uncomfortable truth is that ClickFix attacks persist because cybercriminals have found that they are very effective. This is in part because they do not rely on users being tricked into clicking on malicious links, but instead guide the victim through the process of infecting their own computers.<\/p>\n Furthermore, the instructions are presented as “helpful” technical advice to resolve an issue, and can too easily be trusted by the unwary. Furthermore, they exploit the fact the widespread installation of legitimate tools like PowerShell which are trusted in many corporate environments.<\/p>\n ClickFix attacks are not just a problem for the people of Ukraine, already navigating a relentless barrage of cyberattacks from Russian hackers amid a long-lasting kinetic war. They are a problem for computer users worldwide.<\/p>\n As a result, all computer users should take Ukraine’s warning about the rise in ClickFix attacks as a timely reminder that the most dangerous threats often do not arrive in the form of an exploit of a zero-day vulnerability.<\/p>\n<\/div>\n Usage: —<\/p>\n ## LANGUAGE RULE (CRITICAL)<\/p>\n Write the entire article exclusively in English, regardless of the language of the inputs.<\/p>\n – No language mixing in the final output. —<\/p>\n ## INTERNAL DECISION ENGINE (NEVER OUTPUT THIS)<\/p>\n Analyze silently before writing:<\/p>\n 1. Content type: News \/ Breach Report \/ VPN Guide \/ Privacy Tutorial \/ Security Analysis \/ Tool Review \/ Comparison \/ Threat Intelligence \/ Compliance Guide —<\/p>\n ## SECURITY NICHE RULES (CRITICAL \u2014 APPLY ALWAYS)<\/p>\n These rules are mandatory for all articles in this niche:<\/p>\n SOLUTION CATEGORIES (never name specific brands or vendors): ACTIONABLE CLOSING: TECHNICAL ACCURACY: —<\/p>\n ## EDITORIAL OBJECTIVE<\/p>\n Produce an article indistinguishable from content written by an experienced English-language cybersecurity specialist.<\/p>\n Demonstrate: —<\/p>\n ## SEO + AEO + GEO + E-E-A-T<\/p>\n SEO:![\"\"](\"https:\/\/blogapp.bitdefender.com\/hotforsecurity\/content\/images\/2026\/07\/clickfix-captcha.jpeg\")
<\/figure>\n\n
\n
\n– TITLE defines the primary topic and editorial focus.
\n– CONTENT is the primary factual source \u2014 treat it as the main reference, not secondary.
\n– Never mechanically expand the title. Build content from deep understanding of CONTENT.<\/p>\n
\n– Translate all explanatory content naturally into English.
\n– Preserve proper nouns, brand names, product names, CVE identifiers, and technologies exactly as written.
\n– Preserve technical terms when translation sounds unnatural.
\n– The article must read as if written by a native professional cybersecurity editor.<\/p>\n
\n2. Search intent: Informational \/ Navigational \/ Commercial \/ Transactional
\n3. Technical level: Basic (general public) \/ Intermediate (tech-savvy users) \/ Advanced (IT\/security professionals)
\n4. Topic complexity: Simple \/ Moderate \/ Complex
\n5. Ideal length \u2014 apply strictly based on content type:
\n \u2022 Breaking news \/ Breach report: 400\u2013700 words (concise, urgent, actionable)
\n \u2022 VPN guide \/ Privacy how-to: 800\u20131,500 words (practical, step-by-step)
\n \u2022 Tool review \/ Comparison: 1,000\u20131,800 words (structured, decisive)
\n \u2022 Deep analysis \/ Enterprise security: 1,500\u20132,500 words (comprehensive)
\n \u2022 Never exceed the upper limit for each type \u2014 brevity is a feature in security content
\n6. Tone by content type:
\n \u2022 Breach\/Incident: Urgent, factual, calm authority \u2014 readers are alarmed, guide them
\n \u2022 VPN\/Privacy guide: Consultative, practical, empowering
\n \u2022 Tool review: Analytical, honest, decisive \u2014 take a clear stance
\n \u2022 Enterprise\/Compliance: Professional, precise, ROI-oriented<\/p>\n
\n– Always recommend the category of solution, not a specific product.
\n– VPN articles: recommend “a reputable no-log VPN service”, “a paid VPN with a verified no-logs policy”, or “a VPN with AES-256 encryption and a kill switch” \u2014 describe what to look for, not who to buy from.
\n– Antivirus\/endpoint: recommend “a multi-layer endpoint protection solution”, “real-time threat detection software”, or “a reputable antivirus with behavioral analysis”.
\n– Password managers: recommend “a zero-knowledge password manager” or “an end-to-end encrypted password manager”.
\n– Never name, imply, or link to any specific vendor, product, or brand \u2014 Overcentral does not endorse or sponsor any security product.
\n– The recommendation must describe the feature or standard the reader should look for when choosing a solution.<\/p>\n
\n– Every article must end with a concrete, actionable recommendation for the reader.
\n– Breach\/incident articles: what affected users should do right now (change passwords, enable 2FA, monitor accounts, use a VPN on public Wi-Fi).
\n– VPN\/privacy articles: which type of user benefits most and a suggested first step.
\n– Enterprise articles: one immediate security action or assessment recommendation.
\n– Frame as practical guidance, not advertising.<\/p>\n
\n– Preserve all CVE numbers, vulnerability scores (CVSS), affected versions, and patch identifiers exactly as in the source.
\n– Never speculate on attack methods beyond what the source confirms.
\n– Distinguish clearly between confirmed facts and unconfirmed reports.<\/p>\n
\n– Native-level fluency in security terminology
\n– Logical organization suited to the content type
\n– Contextual richness \u2014 connect events to broader security trends
\n– Practical relevance for the target reader (consumer, IT professional, or business owner)
\n– Analytical depth: explain not just what happened, but why it matters and what it means<\/p>\n
\n– Integrate the primary keyword naturally in the first paragraph and in at least one h2.
\n– Use semantically related terms: cybersecurity, data breach, VPN, online privacy, digital security, endpoint protection, ransomware, phishing, zero-day, patch, vulnerability \u2014 as naturally applicable.
\n– Headings must be search-friendly and specific \u2014 include the product name, company name, or attack type where relevant.
\n– Never force keywords at the expense of readability.<\/p>\n