Russia's Sandworm Hacking Unit Adopted Fake CAPTCHA Attack to Breach Ukrainian Networks, CERT-UA Says

Ukraine's Computer Emergency Response Team, known as CERT-UA, said this week that Sandworm, an elite hacking unit operating inside the GRU, Russia's military intelligence agency, has been using a fake CAPTCHA scam called Clickfix to break into networks belonging to sensitive Ukrainian organizations. According to CERT-UA's advisory, the campaign started in the spring and has continued through the summer. Investigators found at least one confirmed network compromise, where a connected device turned up infected with FreakyPoll, one of Sandworm's custom malware packages.

The attack works like this. A visitor lands on a compromised website and gets a popup demanding they prove they're human. Instead of clicking a box, the fake CAPTCHA tells the user to copy a jumble of text and paste it directly into their computer's terminal. That text is actually a script. Once pasted and run, it installs malware without the user realizing what just happened.

CERT-UA said it identified at least 10 compromised websites rigged with this fake verification prompt, using a PowerShell command dressed up as a routine human-check step. Once a target ran the command, it could drop malicious Visual Basic scripts onto the machine, opening the door for more Sandworm tools.

The first payload is typically a reconnaissance tool called SCOUTCURL, a PowerShell script that quietly collects basic information: what programs are installed, what files exist, browser data, and other details about the machine. That's how Sandworm decides whether a target is worth a deeper compromise, according to the advisory. If a machine is judged important enough, follow-on malware moves in.

CERT-UA named several tools in the kit, including GHETTOVIBE, a script that saves itself into the Windows Startup directory to survive reboots; FluidLeech, which is disguised as antivirus software; and LoadLoop. FreakyPoll, the Python-based backdoor, gives attackers ongoing remote access once installed.

CERT-UA also flagged a piece of custom attacker infrastructure called SMARTAXE, which it says works alongside the Cloaking.House service. Cloaking.House lets attackers filter incoming web traffic and selectively show a fake page, an embedded frame, or a redirect depending on who's visiting. SMARTAXE reportedly does something similar but changes what a visitor sees, including the fake CAPTCHA itself, by dynamically pulling the domain name of a remote resource from a smart contract rather than relying on static rules. That combination lets Sandworm show ordinary users a normal-looking page while serving the malicious CAPTCHA prompt only to specific targets.

CERT-UA also cataloged other Sandworm techniques, including an Android backdoor tracked as CowardDuck that lures targets into installing malicious apps and then exfiltrates files. The advisory noted Sandworm has previously infected devices by seeding torrent trackers with booby-trapped pirated software links, and in other cases has engaged targets in extended Signal conversations before enticing them to install malware disguised as security software.

Why this matters beyond Ukraine

Clickfix isn't new. Financially motivated criminal hacking groups have been running this exact scam for roughly the past year, tricking regular internet users into infecting their own machines by convincing them a fake "verify you're human" step requires pasting code into a terminal.

Sandworm isn't some low-rent criminal outfit phishing for credit card numbers — it's an advanced hacking unit operating inside Russia's military intelligence agency, the GRU. A unit with that pedigree reaching for a cheap social-engineering trick instead of a sophisticated zero-day exploit suggests something simple: Clickfix works, and it's cheap. There's no need to burn an expensive unpatched vulnerability when you can just get a human to paste a command into their own machine.

What's proven and what isn't

CERT-UA's advisory documents a confirmed compromise tied to FreakyPoll and lays out the specific malware chain, the compromised website count, and the tools involved. That's concrete, sourced technical detail from the government body responsible for defending Ukrainian networks. CERT-UA's statement focuses on the technical mechanics rather than attribution evidence tying specific breaches to specific end goals, which is standard for an incident-response advisory rather than a full intelligence assessment.

What comes next

CERT-UA said it analyzed the Clickfix method in detail across more than ten compromised web resources during June and July. CERT-UA's public advisory does not name specific victim organizations. It concluded by calling on website system administrators and hosting providers to monitor for web shells, unauthorized extensions, and other signs of compromise.

No legitimate CAPTCHA or bot-check ever asks a user to open a terminal and paste in a command. If a website does, it's not verifying you're human. It's trying to get malware onto your machine.