cryptothreat

NORTH KOREAN AGENT WORKED INSIDE $ETH METAMASK CODE FOR A MONTH ⚡

From a risk perspective, this type of supply chain infiltration is more alarming than a direct exchange breach. A single developer with access to core wallet code can introduce backdoors into transaction-signing logic or fiat on-ramp integrations. Consensys identified the threat before any assets were lost, but the broader campaign has placed suspected operatives in over 50 crypto projects in six months.

The data point that stands out: the same network behind this infiltration was tied to the $1.5 billion Bybit theft earlier this year. That signals a persistent structural weakness in how the industry vets remote contractors and third-party providers.

How are you assessing contractor risk in the protocols you rely on?

Not financial advice. Always manage your risk.

#ETH #Security #MetaMask #CryptoThreat

⚡

MAC MALWARE THREATENS CRYPTO USERS — $BANK IN FOCUS 🔥

This new Mac exploit targets password managers and encrypted wallet data — a direct hit on how many of us store private keys. Market chatter is already shifting toward tokens like $BANK that focus on decentralized security and privacy. The community is reacting fast, and this could create a temporary rotation into those plays.

If you're trading on a Mac, are you double-checking your vault settings right now?

Not financial advice. Always manage your risk.

#BANK #SecurityAlert #CryptoThreat #MacMalware

⚡

Hackers using the ClickFix technique are now posing as venture capitalists (VCs) and hijacking browser extensions like QuickLens in a wave of cryptocurrency theft attacks.

The ClickFix method, which surged in popularity among crypto scammers last year, tricks victims into manually executing malicious code—often by copying and pasting commands under the pretense of a verification, browser update, or CAPTCHA check. This social engineering bypasses many traditional security defenses, as users unwittingly become the execution mechanism.

Security researchers have monitored ClickFix since 2024, initially seeing it target various sectors beyond just crypto. In the latest incidents, attackers have evolved their tactics in two notable ways:

- Impersonating VCs — Fraudsters create fake firms (e.g., SolidBit, MegaBit, and Lumax Capital) to reach out via LinkedIn with enticing partnership or investment offers. Victims are then directed to bogus Zoom or Google Meet links, setting the stage for further compromise and ClickFix deployment to steal crypto assets.

- Hijacking QuickLens — The previously legitimate Chrome extension "QuickLens - Search Screen with Google Lens" (which had around 7,000 users and once earned a Google featured badge) was compromised after a change in ownership. A malicious update (version 5.8, released around February 17, 2026) introduced info-stealing capabilities and ClickFix prompts. It stripped browser security features, communicated with attacker-controlled servers, displayed fake Google Update alerts, and ultimately targeted cryptocurrency wallets, credentials, seed phrases, and more. The extension has since been removed from the Chrome Web Store.

These attacks highlight how threat actors combine supply-chain compromises (like extension takeovers) with targeted phishing and user manipulation to drain crypto holdings effectively. Users in the crypto space should remain vigilant against unsolicited VC outreach, avoid running unknown commands, and regularly audit installed browser extensions.

#Clickfix #cryptothreat #CryptoAttacks