I just saw a concerning report from Moonlock Lab about a ClickFix attack that involves new techniques, and it's quite clever in a bad way.

Hackers are starting to impersonate investment firms, reaching out via LinkedIn with job invitations, then guiding victims to fake Zoom or Google Meet meeting links. The fake web pages have a Cloudflare button that, when clicked, copies malicious commands to the clipboard and tricks users into pasting and running them in the terminal. This method is effective for hackers because it causes victims to run the commands themselves, bypassing natural security protections.

But there's another serious issue: the Chrome extension called QuickLens was compromised after its ownership changed earlier this month. John Tuckner from Annex Security revealed that attackers released a new version containing malicious scripts after two weeks. The extension has about 7,000 users.

What the extension can do is quite dangerous. It scans digital wallet data, recovery phrases, Gmail information, YouTube data, and login or payment information on various websites. It impersonates organizations like SolidBit, MegaBit, Lumax Capital to appear legitimate.

The extension has been removed from the store, but this serves as a good warning to be cautious about where extensions come from and to be wary of job invitations from strangers on LinkedIn.