ClickFix Moves into the Browser to Steal Cryptocurrency

Cisco Talos observed a persistent ClickFix campaign that shifted from convincing users to paste commands to persuading victims to inject malicious JavaScript (via the Google Visualization API and Tampermonkey) into cryptocurrency trading sites. The scripts acted as crypto skimmers—monitoring page changes, replacing deposit addresses and amounts, overriding fetch and clipboard functions—and were linked to dozens of Bitcoin addresses with confirmed theft and evidence of mixing; the operation survived multiple takedown attempts.