30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
35
30
30
24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
OX Security researchers found 24 npm packages abusing unpkg mirrors to host fake Cloudflare CAPTCHA pages that redirect victims to attacker-controlled phishing infrastructure.
OX Security researchers documented 24 npm packages whose single HTML pages, once mirrored on services like unpkg.com, render as fake Cloudflare CAPTCHA pages on trusted domains and redirect victims to attacker-controlled phishing infrastructure for ClickFix attacks or credential harvesting. An earlier version contacted a typosquat Microsoft login domain (login.microsofte.live); after Chrome Safe Browsing blocklisting, the actor switched to the KeyVal key-value store as a dead drop resolver, currently redirecting to the legitimate ChatGPT site. The approach mirrors Socket's October 2025 report on 175 npm packages abusing unpkg.com in the Beamglea campaign.
50
30
30
30
30
30
30
30
30
30
30
Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency
Cisco Talos tracks a ClickFix crypto-theft campaign using Google Sheets as C2 to swap deposit addresses in Chrome.
Cisco Talos uncovered a cryptocurrency theft campaign that abuses Google Sheets and the Google Visualization API as a covert C2 channel, delivering obfuscated JavaScript into victims' Chrome browser sessions via ClickFix-style social engineering. Victims are lured with a fake "API Logic Flaw" report promising 25-38% bonuses on SimpleSwap and SwapZone swaps; the injected payload acts as a browser-based web skimmer that replaces deposit addresses, overrides the fetch API, and hijacks the clipboard. Later variants use the legitimate Tampermonkey extension with a user script for persistence without OS-level compromise. Talos identified 49 Bitcoin wallets, with 24 reused addresses receiving about 0.159 BTC (~$10,000) before mixing through more than 3,000 addresses.
52
30
30
30
30
30
30