‘ClickFix’ hackers pose as VCs, hijack QuickLens in latest crypto attacks

Crypto Hackers Employ Sophisticated 'ClickFix' Attacks Targeting Users via Fake Venture Capital Firms and Hijacked Browser Extensions

Crypto hackers are escalating their tactics, now impersonating venture capital (VC) firms and exploiting browser extensions in recent 'ClickFix' attacks designed to steal digital assets. Cybersecurity firm Moonlock Lab reported that scammers are posing as VCs like SolidBit, MegaBit, and Lumax Capital, contacting individuals on LinkedIn with fake partnership offers. These offers lead targets to fraudulent Zoom or Google Meet links.

'ClickFix' Attack Mechanism

Upon clicking a malicious link, victims are directed to a fake Cloudflare verification page. Interacting with a fake 'I'm not a robot' checkbox copies a malicious command to the user's clipboard. The attack is executed when the user is prompted to open their computer's terminal and paste this command, effectively bypassing standard security measures without requiring exploits or suspicious downloads. Moonlock Lab noted that this technique turns the victim into the execution mechanism, a highly effective method for attackers.

A person identified as Mykhailo Hureiev, claiming to be co-founder and managing partner at SolidBit Capital, has allegedly been a key contact in the initial LinkedIn phase of these scams. Reports from X users corroborate suspicious interactions with an account bearing Hureiev's name. However, the campaign's infrastructure is designed for adaptability, rotating identities as soon as one is exposed.

Hijacked Chrome Extension Spreads Malware

In a separate but related incident, a malicious Chrome extension named QuickLens was compromised to distribute malware and facilitate 'ClickFix' attacks. QuickLens, an extension that allowed users to perform Google Lens searches within their browser, was removed from the Chrome Web Store after its ownership changed on February 1. Two weeks later, a new version containing malicious scripts was released.

John Tuckner, founder of Annex Security, reported that the compromised extension had approximately 7,000 users. The hijacked extension was designed to search for cryptocurrency wallet data and seed phrases to steal funds. It also exfiltrated data from Gmail inboxes, YouTube channel information, and other sensitive credentials entered into web forms.

Widespread Use of 'ClickFix' Technique

The 'ClickFix' technique has seen a rise in popularity among threat actors since last year due to its effectiveness in bypassing security tools by requiring manual execution of malicious payloads by the victim. Security researchers have been tracking its use since at least 2024, with targets across various industries.

Microsoft Threat Intelligence issued a warning in August of the previous year regarding campaigns targeting thousands of enterprise and end-user devices globally daily. Unit42, a cyber threat intelligence company, reported in July of the same year that this social engineering technique was impacting sectors including manufacturing, wholesale and retail, government, and utilities.