security1 publisher
ClickFix crews shift paste target to Chrome address bar or Tampermonkey
Cisco Talos traces a crypto skimmer running since October 2025 that keeps persistence in a Tampermonkey userscript and pulls its code from a public Google Sheet. Talos says most organisations are not the target.
Publishers:blog.talosintelligence.com
Reality
- Evidence66
- Adoption20
- Hype gap−12
- Incentives55