Russian GRU Hackers Use Fake CAPTCHAs to Compromise Ukrainian Users

Ukraine's CERT-UA reports that the GRU-linked Sandworm (UAC-0145) group is using a 'ClickFix' technique—fake CAPTCHA prompts that induce users to run malicious PowerShell—leading to deployment of the ScoutCurl reconnaissance malware on over ten Ukrainian websites since June 2026; the campaign hides its command-and-control infrastructure in the Ethereum blockchain and CERT-UA notes a large increase in ClickFix incidents (reported 517% rise in H1 2025).