# Clickfix · Drain Watch

3 incidents, 1 live. JSON: https://drains.watch/t/clickfix.json · RSS: https://drains.watch/t/clickfix/feed.xml

- [19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons](https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026) (live, High, Partly contained, since Aug 30, 2026)
- [notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies](https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026) (closed, High, Still active, since Apr 10, 2026)
- [North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech](https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026) (closed, Medium, Still active, since Feb 9, 2026)