Talos spent this week asking whether it’s time to let machines take over threat hunting because humans can’t keep pace with the data anymore. Fair question. Meanwhile, over in Ukraine, Sandworm is breaking into networks with a technique that requires zero machine learning, zero automation, and zero sophistication: a fake CAPTCHA box that tells you to copy a PowerShell command and paste it into Windows yourself. You do the work. They get the shell. This is the state of cybersecurity in 2026, an industry racing to build AI agents smart enough to catch nation-state intrusions, while nation-states keep getting in because someone clicked “I am not a robot” and did exactly what it said.

That gap, between what we’re building and what’s actually working against us, is worth sitting with for a minute.

The Threat Hunting Debate Nobody Needed This Week

Talos’s David Liebenberg makes a reasonable case: alert volume and data velocity have outgrown what human analysts can chew through, and pretending otherwise just means threats sit in the queue longer. Automated hunting, using AI to surface patterns and prioritize leads, can close that gap. Nobody serious is arguing analysts should read every log line by hand anymore.

But the piece also admits the obvious tension: AI can’t be fully trusted. It hallucinates, it misses context, and it’s only as good as the telemetry you feed it. So the real answer isn’t “humans or AI,” it’s humans and AI working the same queue, with AI doing volume and humans doing judgment. That’s not a controversial take. It’s also not a new one. What’s changed is the volume problem has gotten bad enough that skipping automation is no longer a defensible choice for teams doing serious threat detection.

Here’s the catch nobody in that debate wants to say out loud: none of this automation stack would have stopped Sandworm’s CAPTCHA trick, because the attack never touched a system an EDR agent or SIEM rule was watching. It touched a person.

Meanwhile, Sandworm Is Winning With a Copy-Paste

The technique, documented by The Record, is embarrassingly simple. A user lands on a page with a fake “verify you’re human” widget. Instead of clicking a box, they’re instructed to open the Windows Run dialog and paste a command, one that’s already been copied to their clipboard by the page itself. That command kicks off a PowerShell chain that hands Sandworm, Russia’s GRU-linked military intelligence unit, a foothold on a Ukrainian target’s machine.

This is a variant of the “ClickFix” pattern that’s been circulating for over a year now, and it keeps working for the same reason phishing keeps working: it doesn’t ask the victim to bypass a technical control, it asks them to be the technical control’s execution mechanism. No exploit. No malicious attachment scanners can flag. No macro that endpoint protection is trained to block. Just a user, a keyboard shortcut, and a false sense that they’re doing something routine.

Every dollar spent on automated threat hunting, every AI model trained to spot anomalous process trees, still has to contend with the fact that “user manually runs attacker-supplied PowerShell” looks a lot like “user manually runs PowerShell,” full stop. Distinguishing intent from a log line is hard. Distinguishing it from a person’s judgment, in the three seconds before they hit Enter, is the actual chokepoint.

Scattered Spider’s Prison Sentence Won’t Fix This

If you want a second data point on how little the sophistication arms race matters, look at the sentencing news out of London this week. Thalha Jubair and Owen Flowers, two members of the Scattered Spider collective, just got five and a half years each for the Transport for London hack that cost the agency an estimated £29 million. Read the case details and you won’t find a zero-day. You’ll find help desk social engineering, SIM swapping, and MFA fatigue, the same playbook this group and its peers have run against casinos, retailers, and now a metro transit authority.

Good. They should be in prison. But treat this as closure and you’re missing the point: Scattered Spider isn’t a group, it’s a technique that a rotating cast of teenagers keeps executing successfully because organizations still let a phone call to IT override their identity controls. Jailing two members doesn’t patch the help desk process that let them in. Somebody else will make that same call next month.

The thread connecting Sandworm’s CAPTCHA and Scattered Spider’s TfL breach is the same thread connecting them to the AI threat hunting conversation: attackers have figured out that the cheapest way past a well-defended network is to route the attack through a person who’s authorized to do the thing they’re asking for. No amount of automated threat hunting downstream fixes a decision made upstream by someone who had no reason to think twice.

What Actually Stops a Fake CAPTCHA

You’re not going to train every user into permanent suspicion of every popup, and you shouldn’t try. Behavioral fixes at the human layer work best when they’re backed by technical controls that don’t rely on someone getting it right every time. Layer both, because that’s what defense in depth actually means in practice, not a slogan on a vendor slide.

• Restrict who can open the Run dialog and execute raw PowerShell on end-user machines; most office workers never need it.
• Turn on PowerShell Constrained Language Mode and script block logging so anything that does run leaves a trail your team, or your automated hunting tooling, can actually query.
• Push browser and endpoint policies that flag or block clipboard-to-terminal paste patterns, a strong and increasingly common indicator of ClickFix-style delivery.
• Bake a specific “verify-then-execute” step into your incident response runbook for any report of a user pasting instructions from a web page, not just phishing email.
• Tighten help desk identity verification for password and MFA resets; require a callback to a known number or in-person verification, not a caller’s say-so.
• Treat firewall and network egress rules as your last line, not your first; a locked-down outbound policy limits what a successful ClickFix payload can actually reach.

None of this replaces automated threat detection. It just accepts that automation’s job is to catch what gets past the human layer, not to substitute for hardening that layer in the first place. Security hardening that only targets infrastructure while ignoring the Run dialog on every laptop in the building is security hardening with a hole in it.

Sources

• The Hunter’s Paradox: Is it time to embrace automated threat hunting?
• Sandworm hackers have a CAPTCHA trick for Ukrainians
• Scattered Spider members jailed over Transport for London hack that cost £29 million