Pastebin comments push ClickFix JavaScript attack to hijack crypto swaps

New ClickFix JavaScript Attack Leverages Pastebin Comments to Hijack Crypto Swaps

Threat actors are actively using Pastebin comments to distribute a novel ClickFix-style JavaScript attack, specifically designed to trick cryptocurrency users into executing malicious browser scripts to hijack Bitcoin swap transactions and redirect funds.

• Attack Vector/Distribution: Threat actors are abusing the comment sections on Pastebin to host and distribute malicious JavaScript. This implies a reliance on social engineering to entice users to interact with these comments or scripts.
• Execution: The attack methodology involves tricking unsuspecting cryptocurrency users into directly executing the malicious JavaScript within their web browser.
• Target: Individuals engaged in cryptocurrency swap transactions, with a focus on Bitcoin.
• Objective: To reroute legitimate transaction funds from the intended recipient to attacker-controlled cryptocurrency wallets.
• Note: Specific IOCs such as malicious IPs or file hashes were not detailed in the summary.

Defense: Emphasize robust user education regarding the dangers of executing untrusted scripts or interacting with suspicious links, particularly within public comment sections. Implementing browser security extensions that restrict script execution from unknown or untrusted sources can also provide a valuable layer of defense.

Source: https://www.bleepingcomputer.com/news/security/pastebin-comments-push-clickfix-javascript-attack-to-hijack-crypto-swaps/