ClickFix Moves into the Browser to Steal Cryptocurrency
Cisco Talos details a ClickFix campaign injecting browser JavaScript via Google Sheets to skim crypto deposits, stealing at least ~0.159 BTC since October 2025
48
Organization
DarkForums
- Mentions · 7d0
- Mentions · 30d0
- All mentions1
- First seenSep 9, 2026
- Last mentionedSep 9, 2026
Timeline
1 articles · newest firstAppears with
- cryptocurrency trading site usersvictim · 1
- Ciscovendor · 1
- browser-injected JavaScript skimmermalware · 1
- Cisco Talosorganization · 1
- ClickFix operatorsthreat actor · 1
- Google Visualization APIproduct · 1
- Tampermonkeyproduct · 1
- Googlevendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.