Russian hackers use fake CAPTCHA tests to spread new malware families across multiple targets

NEWYou can now listen to Fox News articles!

Russian state-backed hackers have stepped up their game with new malware families that hide behind fake CAPTCHA tests. The group, known as Star Blizzard or ColdRiver, now uses ClickFix attacks to trick people into launching dangerous malware disguised as a simple “I’m not a robot” check.

These attacks represent a new wave of cyber deception, targeting governments, journalists, and NGOs with malware that keeps changing faster than researchers can analyze it.

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join m…

NEWYou can now listen to Fox News articles!

These attacks represent a new wave of cyber deception, targeting governments, journalists, and NGOs with malware that keeps changing faster than researchers can analyze it.

The ClickFix trap: A new kind of social engineering

Google’s Threat Intelligence Group (GTIG) first observed the hackers using LostKeys malware in espionage operations. Once researchers exposed it, the attackers pivoted quickly, abandoning LostKeys within a week and deploying new tools: NoRobot, YesRobot, and MaybeRobot.

NORTH KOREAN HACKERS USE AI TO FORGE MILITARY IDS

The ClickFix attack works like this: a victim lands on a fake CAPTCHA page that looks identical to the real thing. When they click to prove they’re human, the system silently runs NoRobot, infecting the computer and establishing persistence via registry changes and scheduled tasks.

A fake “I’m not a robot” CAPTCHA can launch hidden malware in seconds. (Jens Büttner/picture alliance via Getty Images)

Inside the Russian “robot” malware chain

The Russian hackers built their latest attack around a chain of connected malware families that unfold step by step once a victim clicks the fake CAPTCHA.

NoRobot: The entry point

NoRobot acts as the first stage of infection. It prepares the environment by downloading files, modifying registry keys, and creating tasks to ensure it stays active even after a reboot.

YesRobot: The brief experiment

The hackers briefly tested YesRobot, a Python-based backdoor, but dropped it quickly after realizing the full Python installation drew unwanted attention from defenders.

3,000+ YOUTUBE VIDEOS DELIVER MALWARE DISGUISED AS FREE SOFTWARE

MaybeRobot: The new weapon

MaybeRobot replaced YesRobot as a stealthier PowerShell-based tool. It can download and execute payloads, run command prompts, and send stolen data back to the attackers. Researchers say MaybeRobot’s development has now stabilized, allowing the hackers to focus on refining NoRobot’s stealth.

How these attacks keep evolving

Security analysts noticed the malware’s delivery chain has shifted several times. At one point, it became “drastically simplified,” only to grow complex again as the attackers began splitting cryptographic keys across multiple files. This strategy makes it harder for researchers to reconstruct how infections work. Without every piece of the puzzle, the final malware payload cannot be decrypted correctly.

Who’s being targeted by the Russian malware

ColdRiver’s operations have been linked to the Russian intelligence service (FSB), with years of activity focused on espionage and data theft. The group has consistently targeted Western governments, think tanks, media organizations, and NGOs to steal sensitive information and gain strategic insight.

Despite sanctions, infrastructure takedowns, and public exposure, the hackers continue to evolve. Their quick shift from LostKeys to NoRobot and MaybeRobot shows a highly organized and well-funded operation capable of retooling within days.

Researchers warn that Russian hackers now use realistic CAPTCHA traps to spread new “Robot” malware strains. (Kristian Tuxen Ladegaard Berg/NurPhoto via Getty Images)

CAPTCHAGEDDON SIGNALS A DANGEROUS SHIFT

Even if you’re not a government or corporate target, these evolving attacks serve as a reminder that anyone connected to the internet is at some level of risk. Compromised personal accounts, reused passwords, or infected email attachments can make everyday users an easy entry point for larger campaigns.

While these threats may aim high, their reach extends everywhere. Awareness and cautious online behavior are essential for everyone.

How to stay safe from Russian malware hidden in fake CAPTCHAs

These practical steps can help you protect your data and devices from the growing wave of Russian malware using fake CAPTCHA pages to spread.** **

1) Be cautious with unexpected CAPTCHA challenges

Fake “I’m not a robot” pages are the main lure in this Russian malware campaign. If you’re redirected to a CAPTCHA on an unfamiliar site or after clicking a suspicious link, stop immediately. Real CAPTCHAs usually appear only on trusted websites, not random pop-ups or login pages. When in doubt, close the page and verify the URL before taking any action.

2) Use strong antivirus software

Choose reputable antivirus protection that not only scans for known malware but also monitors suspicious behavior. Since the “Robot” malware evolves rapidly, behavior-based detection helps stop new variants before signature updates are available. Enable automatic updates and schedule daily scans to catch infections early. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

META ACCOUNT SUSPENSION SCAM HIDES FILEFIX MALWARE

3) Consider a data removal service to reduce exposure

Many cyberattacks begin with publicly available data. Using a data removal or privacy protection service helps eliminate your personal information from data broker sites. By reducing what hackers can find online, you make it harder for them to tailor phishing emails or social engineering traps that lead to malware infection.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

4) Keep all software and operating systems updated

The malware used in these attacks exploits known security flaws in unpatched systems. Always apply updates as soon as they’re released. Turn on automatic updates for your browser, antivirus, and operating system. Outdated software is one of the easiest entry points for Russian hackers and other advanced groups.

Cyber experts say awareness is the best defense as these evolving attacks target both organizations and everyday users. (Kurt “CyberGuy” Knutsson)

AI FLAW LEAKED GMAIL DATA BEFORE OPENAI PATCH

5) Use multi-factor authentication (MFA) everywhere possible

Even if a hacker steals credentials through malware or phishing, MFA adds another layer of protection. Require it for email, VPNs, and cloud services. This simple step can block most unauthorized access attempts.

6) Back up data regularly

A ransomware payload could be the next evolution of this malware family. Back up critical data to both an external drive and cloud storage.

Kurt’s key takeaways

The rise of these Russian malware campaigns is a reminder that cybercriminals are always one step ahead. What looks like a harmless “I’m not a robot” test can actually hide a serious threat. Protecting yourself isn’t just about having antivirus software; it’s about staying alert to small online details that can make a big difference. Keep your devices updated, question unexpected pop-ups, and use trusted tools to guard your personal information. With a little caution and consistency, you can outsmart even the most deceptive attacks.

What concerns you most about today’s online security risks? Let us know by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.