Sandworm hijacks CAPTCHA checks to deliver PowerShell malware in Ukraine
Sandworm has repurposed fake CAPTCHA prompts on compromised Ukrainian sites to force users to paste a PowerShell command, installing the GhettoVibe loader. The trick turns a routine verification step into a malware drop, giving the APT deeper footholds and new reconnaissance tools across the target ecosystem.