ClickFix Campaign Uses Fake VCs on LinkedIn to Deliver Malware to Crypto and Web3 Professionals

Moonlock describes an active, targeted campaign that uses LinkedIn personas and spoofed conferencing pages to coerce crypto/Web3 professionals into executing clipboard-pasted commands (ClickFix), delivering stealthy cross-platform malware (in-memory PowerShell on Windows; Homebrew/Python-based installers on macOS); researchers mapped domains, registrant details, and analyzed Mach-O binaries, and observed patterns resembling UNC1069.