「ClickFix」 Attack Upgrade: Hacker Impersonates VC and Hijacks Browser Extension to Steal Crypto Assets

March 3 – Network security firm Moonlock Lab reported crypto hackers have recently upgraded their "ClickFix" attack, now impersonating VC firms to target users via social platforms and trick them into running malicious code to steal crypto assets. Attackers pose as fake VC firms (e.g., SolidBit, MegaBit, Lumax Capital) to send partnership invites via LinkedIn, then direct victims to fake Zoom or Google Meet links. These fake pages include a phony Cloudflare "I’m not a robot" verification button. Clicking it copies malicious commands to the user’s clipboard; victims are tricked into pasting and running those commands in their terminal to complete the hack. Researchers note this tactic bypasses traditional security defenses by getting victims to execute commands themselves. Hackers also hijacked browser extensions to launch attacks. Annex Security founder John Tuckner said the Chrome extension QuickLens—after an ownership change on Feb. 1—rolled out a malicious script update two weeks later. That release triggered the ClickFix attack and stole user data. The extension, which had ~7,000 users, has been removed from the Chrome Web Store. The report adds the hijacked extension scanned for crypto wallet data and mnemonic phrases, plus collected Gmail content, YouTube channel data, and web login/payment info.