What happened
Analysis and impact
Clickfix 的核心思路是通过伪造的错误提示或验证界面诱导受害者手动执行恶意操作，例如复制并粘贴一段看似无害的命令到系统终端或运行对话框中。由于这些操作由用户主动完成，攻击者能够绕过部分依赖自动拦截的安全防护机制。Ars Technica 报道指出，这种技术最初在金融诈骗和勒索软件分发场景中流行，因其部署成本低、成功率相对较高而受到犯罪分子的青睐。
安全研究人员发现，俄罗斯最顶尖的高级持续性威胁（APT）组织近期在其入侵活动中融入了 Clickfix 元素。原文未提供具体组织名称与攻击目标细节，但这一行为模式的变化本身具有指标意义：国家级攻击者正在从地下犯罪生态中吸收经过验证的实用技术，模糊了传统上“国家行为体使用定制化高级工具”与“犯罪团伙使用低成本通用工具”之间的区分。对于防御方而言，这意味着基于攻击者身份假设的检测策略可能需要调整。
从技术扩散的角度看，Clickfix 的跨群体迁移并非孤立现象。近年来，多个 APT 组织被观察到采用原本流行于勒索软件团伙的初始访问手段，反之亦然。此类技术的共同特点是利用人类操作习惯而非纯软件漏洞，这使得单纯依赖补丁管理和端点防护难以完全阻断攻击路径。原文未提供关于 Clickfix 具体变种或近期感染规模的数据，但该趋势提示安全团队需要加强对“用户手动执行可疑指令”这一行为链路的监控与培训。
References
Original source text
One of the Russian government’s most elite hacking groups has adopted an attack, known as Clickfix, to compromise devices belonging to sensitive organizations in Ukraine, the latter country’s CERT center is warning.
Clickfix has emerged as an effective attack technique that attackers, primarily financially motivated criminals, began using in the last year or so. Websites under the control of the attackers display a CAPTCHA that requires the visitor to copy a jumble of text and paste it into the terminal. The text contains scripts that, once entered, perform malicious actions, typically by installing malware or exfiltrating sensitive data. Ukraine’s CERT said Wednesday that Sandworm, an advanced hacking unit inside the GRU, Russia’s military intelligence arm, is now using the technique.
"GhettoVibe," "ScoutCurl," and many more The Clickfix attacks began in the spring and have continued through the summer. The campaign has resulted in the network compromise of at least one organization when a connected device was found to be infected by FreakyPoll, the name of one of Sandworm’s custom malware packages. Ukrainian authorities discovered 10 compromised websites that displayed a PowerShell command as part of a fake CAPTCHA that said it had to be passed to ensure a real human was behind the visiting device’s keyboard.