security firm Source Defense read more about Legacy Stripe API Exploited to Validate Stolen Payment Cards in Web Skimmer Campaign.

ClickFix has abandoned its habit of knocking at PowerShell and has taken up residence directly inside the browser. Cisco Talos has disclosed a campaign in which the victim is invited to paste JavaScript into Chrome's address bar or to install it via Tampermonkey. Once executed, the code operates within the page itself and requires no separate malicious program on the system.

At a Glance Malware type Browser-injected web skimmer Threat actor Unattributed; linked to "The Protocol One" persona Targets Crypto traders using SwapZone and SimpleSwap Delivery vector ClickFix-style lures on Telegram, DarkForums, paste sites Key capabilities Google Sheets C2, address swapping, clipboard hijacking Source Cisco Talos TL;DR Cisco Talos uncovered a crypto-stealing campaign that turns the ClickFix browser attack into a web skimmer.