Cisco Talos Reports ClickFix Attacks Targeting Cryptocurrency Traders

• •Two ClickFix attack campaigns identified targeting cryptocurrency traders.
• •Victims are tricked into executing malicious JavaScript via trusted services.
• •Cisco recommends strengthening browser controls and user education.

Cisco Talos has identified two ClickFix attack campaigns that exploit trusted services to deceive victims into executing malicious code. The first campaign, active since October 2025, targets cryptocurrency traders with fake security reports, leading them to paste JavaScript into their browsers, which then retrieves attack code from a Google spreadsheet. This malware can alter cryptocurrency deposit addresses and has been linked to over $10,000 in Bitcoin theft across 49 addresses. The second campaign, observed in April 2026, uses fraudulent Google verification prompts from a compromised site, resulting in the installation of the Amatera information stealer, which can harvest credentials and cryptocurrency. Cisco advises organizations to enhance browser controls and educate users about legitimate verification processes. The attacks leverage familiar online experiences, making detection challenging.