ClickFix Campaign Uses Fake VCs on LinkedIn to Deliver Malware to Crypto and Web3 Professionals

A coordinated malware campaign is targeting cryptocurrency and Web3 professionals through a carefully built chain of social engineering, fake venture capital identities, and spoofed video conferencing links.

First tracked in early 2026, the operation uses a technique called ClickFix to manipulate victims into running malicious commands on their own machines — making them the unwitting delivery mechanism for the attack.​

The campaign begins on LinkedIn, where an operator using the persona of Mykhailo Hureiev presents himself as Co-Founder and Managing Partner of a fictitious investment firm called SolidBit Capital.

Messages reference the target’s public work in crypto or DeFi communities to build false trust. The conversation then pivots to a scheduled call, where a Calendly link silently redirects the victim to a spoofed Zoom meeting page designed to deliver malware.​

Moonlock analysts identified the infrastructure behind this campaign and traced every malicious domain to a single registrant: Anatolli Bigdasch, located in Boston, Massachusetts, using email anatollibigdasch0717[at]gmail[.]com.

Beyond SolidBit Capital, researchers uncovered two more fake company fronts — MegaBit and Lumax Capital — each with polished websites, AI-generated team headshots, and fabricated company histories.

The domain lumax[.]capital, registered February 2, 2026, signals the threat actors are preparing a new identity to deploy once SolidBit becomes too exposed.​

This campaign delivers cross-platform payloads for both macOS and Windows. On January 9, 2026, a victim using the X handle @0xbigdan shared screenshots of the full interaction, exposing key red flags — including Hureiev joining a real Google Meet, going completely silent, and cutting off the moment the victim pushed back.

Operational patterns closely mirror activity Mandiant attributed to UNC1069, a threat actor with a suspected North Korea connection tracked since 2018, though definitive attribution here remains open.​

The ClickFix Delivery Mechanism

ClickFix is what turns a routine interaction into a full device compromise. When a victim clicks the fake Zoom or Google Meet link, they land on a page resembling real outlets — either The Digital Asset Conference III or a typosquat of Hedgeweek, a legitimate hedge fund publication.

Overlaid on this page is a fake Cloudflare “I’m not a robot” verification box, built entirely from local HTML and CSS with no real Cloudflare infrastructure behind it.​

The moment a user clicks the checkbox, JavaScript silently writes a malicious command to their clipboard via navigator.clipboard.writeText().

The script reads the browser’s User-Agent string to identify the OS and serves a matching payload.

On Windows, the clipboard receives a PowerShell command that hides its window, bypasses execution policies, and uses Invoke-Expression to run a remote script in memory — leaving nothing on disk for antivirus to flag.

On macOS, a bash one-liner installs Homebrew if Python 3 is absent, downloads a Python script from the command-and-control server at hedgeweeks[.]online, and runs it with nohup bash to keep the process alive even after the terminal closes.​

Moonlock researchers analyzed two Mach-O binaries tied to this campaign. The first is a 9.3 MB obfuscated binary padded with garbage code to overwhelm static analysis tools like Ghidra.

The second is a lean 37.6 KB non-obfuscated build with identical core logic. Both recorded zero detections across all antivirus vendors on VirusTotal for an extended period, confirming that evasion is central to how this operation avoids detection.​

Crypto and Web3 professionals who receive unsolicited LinkedIn messages about investment or partnership should verify before responding. Check when company domains were registered and inspect team photos for AI generation.

Run any external Zoom or Calendly link through a URL scanner before clicking. Never paste commands into a terminal as part of any verification step — no real service asks for that.

Treat urgency, pressure to leave LinkedIn, or instructions to run commands on your device as red flags and disengage before acting.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.