Elite Russian APT Adopts Clickfix Tactic

Security researchers have observed a significant shift in the operational tactics employed by Sandworm, the advanced persistent threat group affiliated with the Russian GRU. By transitioning toward the deceptive Clickfix method, these state-sponsored operators are leveraging techniques previously favored by lower-tier cybercriminals to compromise sensitive networks in Ukraine.

The Mechanics of Deception

The Clickfix technique functions as a psychological trap that weaponizes user trust in security infrastructure. Attackers gain control of legitimate websites and inject a fraudulent CAPTCHA prompt, which instructs the visitor to copy and paste a specific text string into their terminal. This text is actually a malicious command designed to execute unauthorized scripts, paving the way for full system compromise.

Ukrainian officials identified at least 10 compromised websites utilizing this method. These pages coerced users into running PowerShell commands under the guise of verifying human identity. Once executed, these scripts facilitate the installation of persistent backdoors and reconnaissance tools, effectively turning a simple user interaction into a catastrophic security breach.

Tactical Evolution in Malware

Sandworm’s adoption of this technique represents a departure from their traditional reliance on booby-trapped pirated software or extended social engineering via encrypted messaging platforms. The group is now deploying a diverse range of custom malware packages designed to assess and exploit the value of a target machine.

The command, as an example, could be intended to load and save a VBS file in the Startup directory. One of the variants of such a program was called GHETTOVIBE. At the next stage, in order to determine the importance of the cyberattack object, the SCOUTCURL software tool can be loaded onto the attacked computer, which is a PowerShell script that performs basic reconnaissance by collecting and exfiltrating information about the computer: basic characteristics, programs, files, Internet browser data, etc.

— CERT-UA, Ukraine's Computer Emergency Response Team

• 10: Number of compromised web resources identified by authorities displaying fake CAPTCHA prompts.
• June-July: The primary timeframe during which the recent wave of Clickfix implementations was analyzed.
• SMARTAXE: A specific program code identified in the campaign that dynamically fetches remote resource domains via smart contract calls.

Infrastructure and Persistence

The sophistication of this campaign extends beyond simple phishing. In addition to standard traffic-filtering services like Cloaking.House, attackers are utilizing the SMARTAXE tool to dynamically alter page content. This ensures that the fraudulent CAPTCHA remains active and elusive to traditional static security analysis. Beyond the primary Clickfix campaign, the group remains active on other fronts, including the use of CowardDuck malware to target and exfiltrate data from Android devices.

Implications for Security

For organizations, this escalation signals that even the most elite threat actors are prioritizing high-turnover, low-effort initial access vectors. The ability to manipulate local terminal processes through user-pasted commands underscores a critical failure point in endpoint security. Administrators must treat any request to copy-paste terminal instructions from an untrusted web source as a high-severity indicator of compromise. Protecting systems now requires more than just perimeter defenses; it demands rigorous monitoring for unauthorized web shells and suspicious PowerShell execution patterns.