Now, even Russia's most elite hackers are using Clickfix to infect devices
Summary
Ars Technica reports that Russia’s elite hacking group Sandworm has adopted the Clickfix social-engineering technique to compromise devices belonging to sensitive Ukrainian organizations. The attack uses fake CAPTCHA challenges that prompt users to run PowerShell scripts, dropping malware such as FreakyPoll, GHETTOVIBE, and SCOUTCURL for reconnaissance and data exfiltration. The advisory details multiple attack chains and urges defenders to monitor for compromised web resources and backdoors, highlighting a broader shift in attacker tradecraft.