Profilo di Wirelesswrs | Binance Square

·

--

Visualizza traduzione

Hackers using the ClickFix technique are now posing as venture capitalists (VCs) and hijacking browser extensions like QuickLens in a wave of cryptocurrency theft attacks. The ClickFix method, which surged in popularity among crypto scammers last year, tricks victims into manually executing malicious code—often by copying and pasting commands under the pretense of a verification, browser update, or CAPTCHA check. This social engineering bypasses many traditional security defenses, as users unwittingly become the execution mechanism. Security researchers have monitored ClickFix since 2024, initially seeing it target various sectors beyond just crypto. In the latest incidents, attackers have evolved their tactics in two notable ways: - Impersonating VCs — Fraudsters create fake firms (e.g., SolidBit, MegaBit, and Lumax Capital) to reach out via LinkedIn with enticing partnership or investment offers. Victims are then directed to bogus Zoom or Google Meet links, setting the stage for further compromise and ClickFix deployment to steal crypto assets. - Hijacking QuickLens — The previously legitimate Chrome extension "QuickLens - Search Screen with Google Lens" (which had around 7,000 users and once earned a Google featured badge) was compromised after a change in ownership. A malicious update (version 5.8, released around February 17, 2026) introduced info-stealing capabilities and ClickFix prompts. It stripped browser security features, communicated with attacker-controlled servers, displayed fake Google Update alerts, and ultimately targeted cryptocurrency wallets, credentials, seed phrases, and more. The extension has since been removed from the Chrome Web Store. These attacks highlight how threat actors combine supply-chain compromises (like extension takeovers) with targeted phishing and user manipulation to drain crypto holdings effectively. Users in the crypto space should remain vigilant against unsolicited VC outreach, avoid running unknown commands, and regularly audit installed browser extensions. #Clickfix #cryptothreat #CryptoAttacks

Hackers using the ClickFix technique are now posing as venture capitalists (VCs) and hijacking browser extensions like QuickLens in a wave of cryptocurrency theft attacks.

The ClickFix method, which surged in popularity among crypto scammers last year, tricks victims into manually executing malicious code—often by copying and pasting commands under the pretense of a verification, browser update, or CAPTCHA check. This social engineering bypasses many traditional security defenses, as users unwittingly become the execution mechanism.

Security researchers have monitored ClickFix since 2024, initially seeing it target various sectors beyond just crypto. In the latest incidents, attackers have evolved their tactics in two notable ways:

- Impersonating VCs — Fraudsters create fake firms (e.g., SolidBit, MegaBit, and Lumax Capital) to reach out via LinkedIn with enticing partnership or investment offers. Victims are then directed to bogus Zoom or Google Meet links, setting the stage for further compromise and ClickFix deployment to steal crypto assets.

- Hijacking QuickLens — The previously legitimate Chrome extension "QuickLens - Search Screen with Google Lens" (which had around 7,000 users and once earned a Google featured badge) was compromised after a change in ownership. A malicious update (version 5.8, released around February 17, 2026) introduced info-stealing capabilities and ClickFix prompts. It stripped browser security features, communicated with attacker-controlled servers, displayed fake Google Update alerts, and ultimately targeted cryptocurrency wallets, credentials, seed phrases, and more. The extension has since been removed from the Chrome Web Store.

These attacks highlight how threat actors combine supply-chain compromises (like extension takeovers) with targeted phishing and user manipulation to drain crypto holdings effectively. Users in the crypto space should remain vigilant against unsolicited VC outreach, avoid running unknown commands, and regularly audit installed browser extensions.

#Clickfix #cryptothreat #CryptoAttacks

Wirelesswrs

Temi in tendenza