A recent surge in phishing attacks has raised alarms across the cryptocurrency community, with meme coin listing and token display pages becoming prominent targets. Hackers are manipulating token metadata to embed links that lead traders to deceptive Cloudflare verification screens.
Phishing techniques target unsuspecting crypto traders
Attackers have begun updating community token profiles with fraudulent website links, which are then automatically shown on widely-used decentralized asset tracking platforms. These tactics have resulted in substantial losses; one reported victim lost $600,000 after falling prey to this scheme.
The method at the core of these attacks is known as ClickFix. Users are prompted to click a fake “Verify you are human” checkbox, which secretly places a malicious command onto their clipboard through JavaScript. They are then instructed to paste the command into PowerShell or Terminal and execute it.
By running this script, individuals inadvertently install malware such as Lumma Stealer. This software is designed to search systems for sensitive files, extract browser data, and steal crypto wallet credentials.
Cybersecurity professionals caution users that legitimate verification services such as Cloudflare do not require administrative scripts to pass CAPTCHA checks. Experts recommend closing questionable token pages immediately and maintaining strict separation between primary crypto wallets and browsers used for exploring unfamiliar meme coins.
Legitimate Cloudflare verification does not involve entering scripts in PowerShell or Terminal. Following instructions from suspicious pages can result in significant financial loss.
Community responds with warnings and preventive advice
After a trader known as Danny lost $600,000 in such an attack, crypto users and security analysts voiced concerns about the rising threat posed by fake verification screens. Sam Security highlighted that ClickFix attacks exploit trust in familiar security prompts, stating that the reliance on manual input from victims allows these schemes to evade traditional download-based protections.
Another user recounted nearly falling victim after visiting a juice store’s website that presented a similar malicious script in the early hours of the morning. The individual recognized the risk at the last minute and reformatted their computer to safeguard their data. This case underscores how timing, fatigue, and recognizable page elements can contribute to poor judgment during potential scams.
Investor Alex Clive advised traders to authenticate crypto projects through official X accounts and trusted listing platforms such as CoinMarketCap and CoinGecko. Clive urged users to check domains carefully, warning that taking extra seconds for verification can prevent considerable losses.
Scammers use VC firm impersonation, browser extension hacks
Threat actors have expanded their approach by impersonating venture capital firms to target crypto project founders through LinkedIn. Research by Moonlock Lab revealed that individuals posing as representatives of companies such as SolidBit, MegaBit, and Lumax Capital contact victims under the guise of partnership opportunities. They subsequently direct targets to fake meeting pages, which use fraudulent Cloudflare checks as part of the ClickFix scam.
This technique leverages social engineering, convincing users to paste harmful commands into their computer terminals. Moonlock Lab identified one frequent contact, using the alias Mykhailo Hureiev, allegedly listed as a co-founder of SolidBit Capital.
In a related campaign, attackers compromised the Chrome extension QuickLens, previously utilized for Google Lens searches. John Tuckner, founder of Annex Security, disclosed that the extension’s ownership changed hands on February 1, followed soon after by a malicious update. This affected around 7,000 users, with the update deploying ClickFix tools and harvesting sensitive data including crypto wallet information, Gmail access, and login credentials.
Mini dictionary: Lumma Stealer – A type of infostealer malware that searches computers for sensitive files, browser-stored passwords, and credentials for crypto wallets, transmitting collected data to attackers.
| Attack Method | Entry Point | Malware Deployed | Estimated Loss / Impact |
|---|---|---|---|
| ClickFix Phishing on Meme Coin Pages | Fake Cloudflare Verification | Lumma Stealer | $600,000 loss (one victim) |
| VC Firm Impersonation | LinkedIn Outreach | ClickFix, Infostealers | Targeted project founders |
| Compromised Chrome Extension | QuickLens Update | ClickFix, Data Stealers | ~7,000 users impacted |
