A browser extension used by over 30,000 users is transmitting Twitch OAuth tokens to a third-party proxy service, potentially allowing account compromise.
The ClickFix campaign has pivoted from OS-level commands to browser-based JavaScript injection, exploiting Google Sheets to steal cryptocurrency from unsuspecting users.
