#ParsedReport #CompletenessMedium
08-09-2026

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

https://blog.talosintelligence.com/clickfix-moves-into-the-browser/

Report completeness: Medium

Actors/Campaigns:
Magecart
Teampcp (motivation: cyber_criminal)

Threats:
Clickfix_technique
Supply_chain_technique
Obfuscator_io_tool
Clipboard_hijacking_technique

Victims:
Cryptocurrency traders, Cryptocurrency trading services

Industry:
Software_development, E-commerce

ChatGPT TTPs:
do not use without manual check
T1027, T1059.007, T1071.001, T1102, T1105, T1140, T1176, T1204.004, T1565.003, T1566.002, have more...

IOCs:
Domain: 2
Url: 2

Soft:
Chrome, Tampermonkey, Telegram, Pastebin

Crypto:
bitcoin

Algorithms:
xor, base64

Functions:
Visualization

Languages:
powershell, javascript

Links:
https://github.com/Cisco-Talos/IOCs