Sandworm

Ukraine warns fake CAPTCHAs are being used to make you hack yourself

Ukraine's CERT-UA has alerted security professionals to a social engineering campaign by the Kremlin-backed Sandworm group that exploits fake CAPTCHA prompts on compromised websites to trick users into executing malicious code. The technique represents a shift toward leveraging user trust in common security mechanisms as an attack vector rather than targeting technical vulnerabilities directly.