Hackers impersonate VCs and hijack the QuickLens plugin to steal crypto using the ClickFix technique

ChainCatcher report, according to Cointelegraph, hackers are exploiting the "ClickFix" attack method to steal cryptocurrencies, with the latest two incidents involving impersonation of venture capital firms and hijacking browser extensions. Cybersecurity firm Moonlock Lab reported that scammers impersonate fake VCs such as SolidBit, MegaBit, and Lumax Capital, contacting users via LinkedIn with offers of collaboration, then directing them to click fraudulent Zoom and Google Meet links. After clicking the links, users are redirected to pages featuring a forged Cloudflare "I'm not a robot" verification box; clicking this box copies malicious commands to the clipboard and prompts users to open a terminal to paste the so-called verification code, thereby executing the attack. Moonlock Lab noted that this technique turns victims into execution agents, bypassing traditional security defenses. Meanwhile, hackers are also distributing malware by hijacking the Chrome extension QuickLens. This extension allows users to run Google Lens searches directly within their browser; after its ownership was transferred, the updated version included malicious scripts capable of launching ClickFix attacks and stealing data. With approximately 7,000 users, the compromised extension searches for cryptocurrency wallet data and seed phrases to steal funds, while also harvesting Gmail inbox content, YouTube channel data, and login credentials or payment information entered into web forms. The extension has since been removed from the Chrome Web Store. The ClickFix technique has gained popularity among hackers since last year, forcing victims to manually execute malicious payloads and affecting thousands of businesses across multiple industries globally.