Fake CAPTCHAs Are Spreading Malware Across Ukraine—Here’s How the ClickFix Trick Works

Ukrainian devices are under a new wave of attack, and this time the bait is something internet users see every day: a CAPTCHA. The Computer Emergency Response Team of Ukraine (CERT-UA) has linked the campaign to UAC-0145, a sub-cluster within the notorious Russian hacking unit Sandworm, which operates under the GRU, Russia’s military intelligence agency.

The method is called ClickFix, and it’s deceptively simple. A user lands on a compromised or malicious site, gets hit with a fake CAPTCHA prompt, and is told to verify they’re human by running a command. That command? It’s actually a download-and-execute payload that infects the machine with data-stealing malware.

This isn’t a novel technique, but it’s proving effective. CERT-UA’s warning highlights how the attackers are tailoring the trick to Ukrainian targets, using lures that feel urgent and legitimate.

How the ClickFix Attack Unfolds

The attack chain starts with a phishing page or a compromised website. Visitors see a CAPTCHA that looks like the standard “I’m not a robot” checkbox or a puzzle. But instead of simply verifying, the page instructs them to open the Windows Run dialog (Win+R) and paste a command.

That command, often obfuscated, reaches out to a remote server, pulls down a malicious script, and executes it. Within seconds, the system is compromised. The malware deployed in these campaigns is designed to siphon credentials, browser data, and other sensitive information.

CERT-UA’s report notes that UAC-0145 has been active in this space for a while, but the ClickFix approach marks a shift toward social engineering that preys on user trust in familiar interfaces.

Why CAPTCHAs Are the Perfect Cover

CAPTCHAs are everywhere. Users are conditioned to solve them without thinking. That conditioning is exactly what the attackers exploit. A prompt that says “Press Win+R, paste this, and hit Enter” doesn’t raise suspicion because it’s framed as a verification step.

In many cases, the fake CAPTCHA even includes a progress bar or a countdown timer, adding pressure to act fast. This urgency is a classic manipulation tactic, and it works.

Who Is Behind UAC-0145?

UAC-0145 is a sub-cluster of Sandworm, a unit with a long history of disruptive cyber operations. Sandworm has been linked to attacks on Ukrainian infrastructure, including the 2015 and 2016 power grid blackouts, as well as the NotPetya worm that caused billions in damage globally.

This new campaign fits a broader pattern of Russian cyber aggression against Ukraine, which has intensified since the full-scale invasion in 2022. The focus on data theft suggests the attackers are after intelligence, not just disruption.

CERT-UA’s attribution is based on technical indicators and infrastructure overlaps with previous UAC-0145 operations. The agency has urged Ukrainian organizations and individuals to be vigilant.

How to Protect Yourself from ClickFix Attacks

The defense against ClickFix is straightforward, but it requires a shift in mindset. Here’s what security experts recommend:

• Never run commands from CAPTCHAs. Legitimate CAPTCHAs never ask you to open a Run dialog or execute a script. If a page does, close it immediately.
• Verify the source. If you’re on a site you didn’t intend to visit, or the URL looks off, don’t interact with it.
• Keep systems patched. Malware often exploits unpatched vulnerabilities. Regular updates reduce the risk.
• Use endpoint protection. Modern antivirus and EDR tools can detect and block the malicious scripts before they execute.
• Train users. Awareness is the first line of defense. If people know what ClickFix looks like, they’re less likely to fall for it.

What CERT-UA’s Warning Means for the Broader Threat Landscape

This campaign is a reminder that state-sponsored hacking groups are constantly evolving their tactics. ClickFix isn’t new—researchers have documented it since 2023—but its adoption by a group like Sandworm signals that it’s now a mainstream tool in the espionage playbook.

The targeting of Ukrainian devices is no surprise. But the same technique can be repurposed for any region. Organizations worldwide should treat fake CAPTCHA prompts as a potential red flag.

For more on how to spot phishing and social engineering attempts, check out our guide on recognizing phishing emails. And if you’re responsible for security in your organization, it’s worth reviewing endpoint security best practices to close gaps that attackers like UAC-0145 exploit.

The bottom line: trust nothing that asks you to run a command. That CAPTCHA might be more than an annoyance—it could be the door to a compromised network.

Researchers Show Spectre Can Still Bite in Cloudflare Workers

Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second. That’s 360 times the rate of an earlier attack demonstrated in 2021.

The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers, both running on the same physical machine. The attack exploited speculative execution to leak the JWT — a credential used for authentication — in real time.

The findings, presented at a recent security conference, underscore that Spectre-class vulnerabilities remain a practical threat even in managed serverless platforms. The researchers achieved a leak rate of 12 bits per second, which might sound slow, but it’s enough to exfiltrate a typical JWT in under a minute.

How the Attack Works

The attack relies on the same fundamental flaw as the original Spectre: speculative execution. By tricking the CPU into executing instructions out of order, the attacker can access memory that should be off-limits.

In this case, the attacker Worker uses a timing side channel to read sensitive data from the victim Worker’s memory. The researchers demonstrated that the technique works reliably in Cloudflare’s production environment, not just in a lab.

The 2021 Baseline

Back in 2021, a similar attack was shown to leak data at just 0.033 bits per second. That was largely theoretical — too slow to be practical. The new attack’s 12 bits per second changes the calculus.

“At this rate, stealing a full JWT is not just possible but feasible within a short window,” the researchers noted in their paper.

Why This Matters for Cloudflare Users

Cloudflare Workers is a popular serverless platform used by millions of developers. If you’re running Workers that handle sensitive data — like JWTs, API keys, or user PII — this attack is a wake-up call.

The researchers emphasized that the attack requires co-location, meaning the attacker must land on the same physical server as the victim. Cloudflare’s isolation measures make this harder, but not impossible.

For developers, the practical takeaway is to avoid storing long-lived secrets in Worker memory. Rotate JWTs frequently and use short expiry times to limit the damage if a leak occurs.

Cloudflare’s Response and Mitigations

Cloudflare has acknowledged the research and implemented additional mitigations. The company has a history of hardening its platform against Spectre, but this new attack shows that the arms race is ongoing.

Mitigations include:

• Enhanced isolation between Workers on the same machine
• Randomized memory layouts to make timing attacks harder
• Ongoing monitoring for speculative execution anomalies

Cloudflare also advises users to follow best practices for secret management, such as using environment variables and avoiding hardcoded credentials.

Broader Implications for Serverless Security

This research isn’t just about Cloudflare. It highlights a broader issue: serverless platforms are not immune to CPU-level attacks. Any platform that runs untrusted code on shared hardware is potentially vulnerable.

Other providers like AWS Lambda and Google Cloud Functions face similar challenges, though they haven’t yet seen public demonstrations at this speed.

The researchers suggest that hardware-level fixes, like those in newer CPUs, are the long-term solution. Until then, software mitigations and vigilant secret management are the best defense.

What Developers Should Do Now

If you’re a Cloudflare Workers user, don’t panic — but do take action. Start by auditing your Workers for sensitive data in memory. Use short-lived JWTs and rotate them frequently.

Consider using Cloudflare’s built-in secrets management and avoid storing tokens in global variables. Also, keep an eye on Cloudflare’s security advisories for updates.

The 12 bits per second leak rate is a proof of concept, but it’s a serious one. As the researchers put it, “The era of dismissing Spectre as theoretical is over.”

For more on related topics, check out our coverage of Spectre mitigation strategies and serverless security best practices.

Citrix NetScaler Authentication Bypass: The 9.3 Severity Flaw

Citrix has rolled out patches for two vulnerabilities in its NetScaler ADC and NetScaler Gateway products. The more serious of the two, tracked as CVE-2026-19490, carries a CVSS score of 9.3 and is described as an authentication bypass using an alternative path.

This Citrix NetScaler authentication bypass impacts appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. The worst part? It can be exploited by remote, unauthenticated attackers without any user interaction, according to cybersecurity firm Rapid7.

Which NetScaler Versions Are Vulnerable?

Per Citrix’s advisory, the security defect impacts a wide range of NetScaler ADC and NetScaler Gateway versions. The list includes 14.1-43.56 or later, 14.1-66.68-FIPS or later, 14.1-43.55 or earlier, 13.1-61.28 or later, 13.1-61.27 or earlier, and 13.1 FIPS.

If you’re running any of these, you need to act. The fixed versions are:

• 14.1-73.32
• 13.1-63.21
• 14.1-73.32 FIPS
• 13.1-FIPS and 13.1-NDcPP 13.1-37.277

These builds also contain fixes for CVE-2026-19489, a high-severity memory overflow issue. That one could lead to unexpected behavior or denial-of-service (DoS) if SIP ALG is enabled at an LSN group configuration.

Secure Private Access Hybrid Deployments Also Affected

Citrix notes that Secure Private Access Hybrid deployments using NetScaler instances are also affected by these vulnerabilities. Customers need to upgrade these NetScaler instances to the recommended builds to address the issues.

Why Experts Expect Quick Exploitation

Rapid7 says there are currently no indicators that threat actors are exploiting the authentication bypass issue. But that’s likely to change. NetScaler’s critical role within enterprise systems makes it an attractive target for hackers.

The firm points out that NetScaler ADC and NetScaler Gateway are widely deployed enterprise networking products commonly positioned at or near the network perimeter. NetScaler ADC provides application delivery, traffic management, load balancing, SSL/TLS offloading, and application security capabilities, while NetScaler Gateway provides secure remote access and VPN functionality.

Given that NetScaler appliances are typically deployed in enterprise DMZs and are publicly accessible, Rapid7 expects threat actors to exploit the critical bug shortly. The company’s advice is blunt: organizations should prioritize patching affected systems on an emergency basis, since Citrix products are high-value targets that tend to quickly see exploitation in the wild.

This isn’t the first time Citrix NetScaler has been in the spotlight for security issues. Past incidents have shown that attackers move fast when it comes to these devices. For a broader look at how similar flaws have played out, check out our coverage of the critical GitLab flaw exploited shortly after disclosure and the previous Citrix NetScaler HTTP/2 bomb attack.

What Should Organizations Do Now?

The message from security researchers is clear: don’t wait. If your organization uses Citrix NetScaler ADC or Gateway, verify your version and apply the patches immediately. The authentication bypass issue is too dangerous to leave unaddressed, especially given the public accessibility of these devices.

For those who need more context on how similar vulnerabilities have been handled, our article on the exploitation of a fresh Citrix NetScaler vulnerability offers useful background on the threat landscape surrounding these products.

Stay ahead of the curve by keeping your NetScaler deployments up to date and monitoring Citrix’s security advisories regularly. The window for safe patching may be smaller than you think.