{"id":369621,"date":"2026-07-21T12:01:58","date_gmt":"2026-07-21T06:31:58","guid":{"rendered":"https:\/\/ebiztoday.news\/?p=369621"},"modified":"2026-07-21T12:01:58","modified_gmt":"2026-07-21T06:31:58","slug":"now-even-russias-most-elite-hackers-are-using-clickfix-to-contaminate-devices","status":"publish","type":"post","link":"https:\/\/ebiztoday.news\/index.php\/2026\/07\/21\/now-even-russias-most-elite-hackers-are-using-clickfix-to-contaminate-devices\/","title":{"rendered":"Now, even Russia’s most elite hackers are using Clickfix to contaminate devices"},"content":{"rendered":"
\n

Considered one of the Russian government\u2019s most elite hacking groups has adopted an attack, often known as Clickfix, to compromise devices belonging to sensitive organizations in Ukraine, the latter country\u2019s CERT center is warning.<\/p>\n

Clickfix has emerged as an efficient attack technique that attackers, primarily financially motivated criminals, began using within the last yr or so. Web sites under the control of the attackers display a CAPTCHA that requires the visitor to repeat a jumble of text and paste it into the terminal. The text incorporates scripts that, once entered, perform malicious actions, typically by installing malware or exfiltrating sensitive data. Ukraine\u2019s CERT said<\/a> Wednesday that Sandworm<\/a>, a sophisticated hacking unit contained in the GRU, Russia\u2019s military intelligence arm, is now using the technique.<\/p>\n

\u201cGhettoVibe,\u201d \u201cScoutCurl,\u201d and plenty of more<\/h2>\n

The Clickfix attacks began within the spring and have continued through the summer. The campaign has resulted within the network compromise of at the least one organization when a connected device was found to be infected by FreakyPoll, the name of considered one of Sandworm\u2019s custom malware packages. Ukrainian authorities discovered 10 compromised web sites that displayed a PowerShell command as a part of a fake CAPTCHA that said it needed to be passed to make sure an actual human was behind the visiting device\u2019s keyboard.<\/p>\n

Once the user entered the script, it could install malicious Visual Basic scripts and other malicious wares that went on to put in a wide range of Sandworm malware. Typically, the primary malware to run was a reconnaissance program that gathered information from the infected device. Machines deemed necessary would then receive follow-on malware that backdoored the system.<\/p>\n

\u201cThe command, for example, could possibly be intended to load and save a VBS file within the Startup directory,\u201d a translated version of Tuesday\u2019s advisory stated. \u201cConsidered one of the variants of such a program was called GHETTOVIBE. At the subsequent stage, in an effort to determine the importance of the cyberattack object, the SCOUTCURL software tool might be loaded onto the attacked computer, which is a PowerShell script that performs basic reconnaissance by collecting and exfiltrating information in regards to the computer: basic characteristics, programs, files, Web browser data, etc.\u201d<\/p>\n<\/p><\/div>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Considered one of the Russian government\u2019s most elite hacking groups has adopted an attack, often known as Clickfix, to compromise devices belonging to sensitive organizations in Ukraine, the latter country\u2019s CERT center is warning. Clickfix has emerged as an efficient attack technique that attackers, primarily financially motivated criminals, began using within the last yr or […]<\/p>\n","protected":false},"author":1,"featured_media":369622,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[44184,1107,2065,5110,44018,20803],"class_list":["post-369621","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-clickfix","tag-devices","tag-elite","tag-hackers","tag-infect","tag-russias"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t