Russia's top-tier state hackers are now using ClickFix.

Ars Technica reports that APT-grade Russian groups have adopted the fake-CAPTCHA paste-this-command technique previously confined to financially motivated crooks. When a commodity technique migrates up to nation-state operators, it means it works well enough that sophistication isn't worth the cost. If your docs or your agent ever tell a user to paste a shell command, you're training the exact behavior this exploits.