Russian Sandworm uses CAPTCHA to infect Ukrainian sites

A Russian military intelligence hacking group has adopted a simple but effective social engineering technique, known as ClickFix, to compromise sensitive Ukrainian organizations, according to a recent advisory from Ukraine's Computer Emergency Response Team (CERT-UA). The group, tracked as Sandworm, APT44, and UAC-0145, is a unit within Russia's GRU military intelligence agency.

The technique involves displaying a fake CAPTCHA prompt on compromised websites. Visitors are instructed to copy a string of text and paste it into their Windows PowerShell terminal or Run dialog to supposedly verify they are human. Instead, the pasted command executes a malicious script that infects the computer. This method, which gained popularity among financially motivated cybercriminals in recent years, represents a tactical shift for the elite state-sponsored group, which has been observed using it extensively since spring 2026.

The initial script typically installs a Visual Basic script called GhettoVibe, which places itself in the Windows Startup folder to ensure persistence. A reconnaissance tool named ScoutCurl is then deployed to gather system details, installed programs, file lists, and...