Placeholder domain used in dev docs now serves ClickFix attacks
Placeholder domain third-party.com, referenced across 1,700+ repositories, now serves fake Cloudflare ClickFix pages pushing clipboard-copied PowerShell commands at Windows users.
Stories per day · 30 days
4 stories, newest first · one card per story
Stories tagged #clipboard-hijacking
India’s STPI serves TerminalFix-style attack via fake Cloudflare check
India's STPI government website serves a spoofed Cloudflare verification page that preloads malicious commands into visitors' clipboards for execution in Windows Terminal, matching TerminalFix-style attacks.
6
Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks
Cisco Talos details a crypto-theft ClickFix campaign abusing Google Sheets to swap wallet addresses, with about $10,000 in observed Bitcoin losses.
2
Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency
Cisco Talos tracks a ClickFix crypto-theft campaign using Google Sheets as C2 to swap deposit addresses in Chrome.
1