Clickfix - GoKawiil

Malicious Chrome and Edge extensions hijacked to steal crypto wallets, browser data

Security firm Socket uncovered a campaign, active since early 2024, in which 16 malware modules were pushed through browser extensions on the Chrome Web Store and Microsoft Edge add-ons store. Five extensions were initially legitimate but were bought from their original developers and later turned malicious via automatic updates, including one tool with roughly 70,000 Chrome users and 10,000 Edge users. Once activated, the extensions connected to remote servers to strip website security headers, inject phishing scripts, and drain cryptocurrency wallets on platforms like Coinbase, Binance, Kraken and MetaMask.

bleepingcomputer.com · 2026-08-30

New WordlistLoader Malware Hides Amatera Infostealer in Plain Text Files

Researchers have identified a new loader tool called WordlistLoader that disguises malicious code as ordinary text files, such as word lists, to slip past security defenses. It's being used in ClickFix-style attacks—where victims are tricked into manually executing commands—to deploy the Amatera infostealer, a malware family that has been rapidly gaining traction among cybercriminals.

darkreading.com · 2026-08-24