Loading story…
CERT-UA warned that the Russian state-linked Sandworm group has adopted the ClickFix social-engineering technique to target Ukrainian organizations, using compromised websites and fake CAPTCHA pages that trick users into copying and pasting malicious PowerShell commands. Those commands reportedly download and execute multiple payloads, including FreakyPoll, GHETTOVIBE, SCOUTCURL, FluidLeech, and LoadLoop, while Sandworm also used a custom utility called SMARTAXE to support the CAPTCHA-hosting infrastructure by querying Ethereum smart contracts for domain lists. CERT-UA said the activity began in spring 2026 and continued through summer, with at least ten sites identified as hosting the malicious lure infrastructure.
The campaign reflects a broader surge in ClickFix and related copy-and-paste attack variants such as CrashFix, InstallFix, and FileFix, which security researchers say are increasingly used for initial access and malware delivery. Huntress reported a sharp rise in ClickFix incidents, while other documented cases have shown attackers chaining fake browser extensions, obfuscated PowerShell, finger.exe, Python-based remote access tools, persistence via Run keys and scheduled tasks, and staged payload downloads. Defenders were urged to look beyond the lure pages and hunt for compromised web servers, web shells, unauthorized CAPTCHA content, suspicious process chains, dropped files, persistence artifacts, and outbound connections tied to follow-on malware activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
JFrog reported in March 2026 that a malicious npm package posing as OpenClaw used a postinstall hook, fake installer prompts, password harvesting, and a second-stage payload fetched from trackpipe[.]dev.
Microsoft reported a February 2026 ClickFix-style campaign dubbed CrashFix in which a fake browser extension led victims to run obfuscated PowerShell, abuse finger.exe, deploy WinPython and a Python RAT, and establish persistence via Run keys and scheduled tasks.
CERT-UA said Sandworm's ClickFix activity continued through summer 2026, with at least ten websites identified as hosting malicious CAPTCHA infrastructure and payload delivery for malware including FreakyPoll, GHETTOVIBE, SCOUTCURL, FluidLeech, and LoadLoop.
CERT-UA said the Russian APT group Sandworm started using the ClickFix social engineering technique in spring 2026 to target devices of interest in Ukraine via malicious CAPTCHA pages that trick users into pasting PowerShell commands.
Huntress reported a 631% increase in ClickFix-related incidents, highlighting the growing prevalence of copy-and-paste social engineering attacks.
CERT-UA warned that Sandworm was using ClickFix against Ukrainian organizations and described SMARTAXE, a custom tool that queried Ethereum smart contracts for domain lists to support the CAPTCHA-hosting infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcepentestpartners.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT-UA reported that the Russia-linked **Sandworm** cluster `UAC-0145`, tied to `UAC-0002` and also tracked as **APT44** and **Seashell Blizzard**, has run a sustained campaign against Ukrainian targets using several social-engineering and malware-delivery methods. Investigators said attackers compromised more than 10 websites and deployed **ClickFix**-style fake CAPTCHA pages that instructed visitors to paste malicious PowerShell commands into Windows, while other lures included trojanized software installers from torrent trackers, bogus antivirus installation requests sent through Signal, and a fake Android security app. CERT-UA linked the activity to long-running operations targeting Ukrainian government and military-related organizations. The campaign used a broad malware ecosystem including **GHETTOVIBE**, **SCOUTCURL**, **FLUIDLEECH**, **LOADLOOP**, **FREAKYPOLL**, **SMARTAXE**, and the Android backdoor **COWARDDUCK**, alongside legitimate tools such as **OpenSSH**, **Tor**, and **rsync** for persistence, tunneling, and exfiltration. CERT-UA said at least one infection delivered through a trojanized installer enabled persistence and lateral movement inside an organization and was later used in a destructive attack against the infrastructure of a central executive authority of Ukraine. Analysts also found the operators using **Cloaking.House** and blockchain `eth_call` lookups to retrieve remote domains dynamically, while the Android malware was capable of stealing files, contacts, device data, and real-time geolocation and used the Dropbox API and content from legitimate services in its command-and-control workflow.
Jul 19, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
A **ClickFix**-style malware campaign has been observed using **fake CAPTCHA** pages on compromised websites to trick users into **manually executing** malicious commands, enabling initial access while evading controls that focus on downloaded files. In the reported activity, victims are prompted to copy a **PowerShell** command and run it themselves; the script then downloads additional stages from attacker infrastructure (including `91.92.240.219`), verifies user interaction by checking clipboard activity, and proceeds through a multi-stage infection chain. The payload is an **information stealer** targeting data from **25+ web browsers**, cryptocurrency wallets (e.g., *MetaMask*), and enterprise VPN configurations, with checks for virtualized environments and security tooling prior to exfiltration. Separately reported threat activity in the same time window includes **UnsolicitedBooker** targeting Central Asian telecoms with phishing-delivered backdoors (**LuciDoor** and **MarsSnake**) and **APT28** running *Operation MacroMaze*, which uses weaponized Office documents and `INCLUDEPICTURE` fields pointing to `webhook[.]site` URLs as a tracking mechanism and to support follow-on macro-based payload delivery. A video-style weekly briefing also mentions an evolution of ClickFix where an initial command uses `nslookup` and parses the response for execution, but it is a multi-topic roundup rather than a primary source on the fake-CAPTCHA infostealer campaign; a malware newsletter roundup is likewise a link collection and does not add specific, corroborating details about the ClickFix CAPTCHA infostealer operation.
Jun 29, 2026