Russia's Sandworm hackers have started deploying Clickfix to target Ukrainian organizations

Sandworm, a sophisticated hacking unit within Russia's military intelligence service (GRU), has begun exploiting a technique called Clickfix to infiltrate devices belonging to sensitive organizations in Ukraine, according to a warning issued by the Ukrainian government's cybersecurity center.

How Clickfix works as an infection vector#

The attack leverages a social-engineering approach that has proven effective. Visitors to compromised websites encounter what appears to be a legitimate security check — a CAPTCHA screen instructing them to copy a block of text and paste it into their terminal. The seemingly innocent command actually contains malicious code. Once executed, these scripts can install dangerous malware or steal confidential information from the affected machine.

Though Clickfix originated with financially motivated cybercriminals in the past year, it has now become a preferred tool for state-sponsored attackers. Sandworm's adoption of this method signals how mainstream the technique has become among high-tier threat actors.

Sandworm's campaign mechanics#

The Ukrainian government documented multiple waves of Clickfix attacks launched by Sandworm starting in spring and continuing through summer. Investigators uncovered at least ten websites displaying fraudulent PowerShell commands disguised as CAPTCHA validation steps. Victims who complied unknowingly executed a chain of malicious payloads.

The initial stage typically deployed reconnaissance software designed to profile the compromised device. Machines identified as high-value targets then received additional malware configured to establish persistent backdoor access. At least one organization suffered confirmed network compromise through this method, with the FreakyPoll malware—a known Sandworm custom weapon—recovered from infected systems.

Multi-stage payloads and information harvesting#

The malware infrastructure used in these attacks followed a layered approach. One variant, dubbed GhettoVibe, installed itself in Windows startup directories to ensure persistence. A secondary tool called ScoutCurl—a PowerShell reconnaissance script—would then execute on high-priority targets to catalog system information, installed software, files, and browser data for exfiltration.