Vendor

Netskope

1 mentions in 7 days · 1 in 30 days · 2 total · first seen Aug 12, 2026 · last 4d ago

Timeline2 articles

ClickFix attacks infecting PCs and Macs are going viral

ClickFix social engineering attacks are spreading widely, delivering malware to Windows and macOS users by tricking them into running malicious terminal commands that bypass Gatekeeper.

BlueVoyant reports the Lorem Ipsum malware operation pivoted to ClickFix in late May 2026, dropping code-signing infrastructure and broadening its victim pool from Microsoft Teams searchers to anyone browsing a compromised website. Jamf and independent researchers documented macOS ClickFix variants that bypass Gatekeeper protections. Cisco Talos observed attackers abusing published Google Sheets for control traffic, while Netskope counted 5,400 sites beaconing to one campaign; Sandworm has separately hosted control infrastructure in blockchain smart contracts.

Ars Technica · SecuritySep 11, 11:30 UTC · 4d agoPhishing & fraud in the wild1

737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One

Researchers found 737 Chrome VPN extensions, many impersonating brands like NordVPN, routing roughly 75,000 users' browser traffic through attacker-controlled SOCKS5 proxies.

Socket and researcher Kush Pandya identified 737 Chrome VPN and proxy extensions, published across at least 40 developer accounts with 75,486 installs, that route entire browser sessions through one provider's SOCKS5 proxies on port 1082. Of these, 274 impersonate 66 established brands including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare 1.1.1.1. The proxy bypass list only excludes loopback addresses, exposing visited destinations, source IPs, TLS SNI values, and plain-HTTP request bodies to the operator. 221 extensions have been removed from the Chrome Web Store while 516 remain listed as active.

The Hacker NewsAug 12, 14:09 UTC · Aug 12, 2026Malware

Appears with

organization Netskope 2 threat actor Sandworm 1 malware AI Sidebar 1 organization BlueVoyant 1 organization Cisco Talos 1 organization Jamf 1 product BlockBlock 1 product Chrome Web Store 1 product ExpressVPN 1 product NordVPN 1 product Proton VPN 1 product SopraVPN 1 product Surfshark 1 product uBlock 1 vendor BlueVoyant 1 vendor Cisco Talos 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.