# Sandworm Turns Users Into Their Own Attackers With Fake CAPTCHA Lure
A checkbox shouldn't be able to compromise your machine. But if you visit the wrong website — one that looks entirely normal until a CAPTCHA prompt appears — and follow the instructions that pop up, you might spend the next several minutes unwittingly installing Russian malware on your own computer. That's the trap Ukraine's CERT-UA is now warning about, and it has Sandworm's fingerprints all over it.
## The Mechanic: When the CAPTCHA Is the Attack
The technique being deployed here belongs to a class of social engineering now commonly called ClickFix. The setup is deceptively simple: a compromised legitimate website intercepts the user experience and throws up what looks like a CAPTCHA verification screen. Instead of clicking pictures of traffic lights, however, the fake prompt tells the user they need to prove they're human by following a series of steps — typically something like "press Windows key + R, then paste the following command."
That command is PowerShell. The content of it isn't something a non-technical person would recognize as dangerous. It looks like an activation code or a browser verification string. What it actually does is pull down and execute a malicious payload from an attacker-controlled server.
The genius — and it deserves that word, however grudgingly — is that the user becomes the delivery mechanism. No browser exploit needed. No zero-day. No phishing email to filter. The attacker has simply reframed the attack as a required step in an everyday task. Most endpoint security products aren't looking for users who manually paste commands into Run dialogs. Behavioral detection tools are built around what software does, not what humans do.
## Sandworm Doesn't Waste Tricks Like This on Random Targets
Sandworm — GRU Unit 74455, if you prefer official designations, or APT44 in Mandiant's taxonomy — is not a group that runs opportunistic campaigns. This is the crew behind NotPetya, the 2015 and 2016 Ukrainian power grid attacks, Olympic Destroyer, and a decade of precision-targeted infrastructure disruption. When Sandworm adopts a new technique, it's because they've assessed it as effective for a specific operational objective.
The fact that they're deploying ClickFix via compromised legitimate websites — a watering hole strategy — rather than through spearphishing emails tells you something about their targeting mindset right now. Watering holes are for reaching people who won't click an email attachment but will visit a specific website. Sector-specific news sites, government portals, industry forums, local Ukrainian news properties. You put a fake CAPTCHA on those, and you're not catching everyone — you're catching the specific category of person who reads that content.
CERT-UA's warning doesn't specify which websites were compromised or which sectors are being targeted, but that operational pattern suggests this is aimed at Ukrainian government employees, defense sector workers, journalists, or others in roles Sandworm has historically cared about.
## ClickFix Isn't New — But Nation-State Adoption Changes the Calculus
ClickFix as a delivery mechanism started showing up in cybercriminal campaigns in early 2024, attributed initially to a threat cluster called TA571 and later to numerous other groups. It spread fast because it works: security awareness training teaches people to spot suspicious email attachments and fake login pages, but nobody's ever taught their employees "don't paste commands into the Run dialog because a CAPTCHA told you to."
By late 2024 and into 2025, security researchers documented ClickFix being used to distribute everything from AsyncRAT and Lumma Stealer to Quakbot variants. It became a commodity technique, available across the criminal ecosystem. The arc from "novel criminal tactic" to "commodity" to "nation-state adoption" typically takes years. ClickFix moved through that arc in roughly eighteen months.
Sandworm's adoption closes that loop. When sophisticated state-level actors start using a technique that was developed by financially motivated criminals, it means two things: the technique has proven durable against defenses, and the barrier to adoption is low enough that even well-resourced groups find it faster and cheaper than developing novel exploits.
## What Defenders Are Actually Up Against
The honest problem here is that ClickFix attacks are difficult to stop at a technical layer precisely because the malicious action happens at the user layer. You can't block a CAPTCHA page — that breaks legitimate CAPTCHAs. You can't block Run dialog usage — that breaks legitimate administrative tools. You can deploy PowerShell execution policies and AppLocker rules, but users with elevated permissions can sometimes bypass those, and CERT-UA's advisory doesn't specify what the actual malware payload does once it lands.
What you can do:
If you're a Ukrainian government entity or any organization with Ukrainian business relationships, this is not theoretical. CERT-UA is warning about active campaigns, not hypothetical ones.
---
## HackWire Analysis
What's underreported in most coverage of this Sandworm ClickFix campaign is what the watering hole component reveals about the maturity of this operation. Sandworm has historically combined watering holes with zero-day browser exploits — visit the site, get owned, no user interaction required. The shift to ClickFix instead of a browser exploit is worth examining.
One interpretation: they're preserving zero-days for higher-value targets and using social engineering for volume operations. Another: this is specifically designed to defeat the hardened browser environments increasingly common in Ukrainian government organizations, where patch cycles are fast and exploit windows are narrow. A third possibility, and the one that should concern defenders most: they're testing ClickFix at scale to refine the lure, before combining it with something more technically severe.
The pattern also fits what we've seen from Iranian and North Korean APTs over the past two years — state actors increasingly borrowing criminal TTPs because those techniques are tested, effective, and generate operational noise that obscures attribution. When Lazarus Group adopts a technique from a ransomware crew, analysts debate whether it's state-sponsored. That ambiguity is a feature, not a bug.
What's missing from most reporting here: nobody's clearly documented what the final payload looks like. CERT-UA has warned about the delivery mechanism, which is valuable, but defenders need to know whether this is reconnaissance-stage malware, wiper staging, or credential theft tooling. The answer dictates how you prioritize your response. Until that's public, treat this as initial access infrastructure — Sandworm's endgames are rarely subtle.
Organizations outside Ukraine aren't safe spectators. Sandworm has demonstrated willingness to let collateral damage spread globally — NotPetya cost $10 billion worldwide with $300 million hitting just Maersk. If compromised websites in this campaign serve international audiences, the fake CAPTCHA doesn't know where you're based.
— HackWire Editorial
---
## Related Coverage