Fake Advisors, ClickFix, and Chrome Sync Spying

How the attacks worked

This roundup covers three distinct techniques that rely on manipulating trust and access rather than exploiting software flaws alone.

In the investment fraud scheme, call-center staff posed as financial advisors and built rapport with victims over a period of months. Victims were guided to make a small initial deposit that showed an immediate profit on a realistic-looking platform, which encouraged them to deposit larger sums over time, often in cryptocurrency.

Separately, a financially motivated group used ClickFix lures, prompts that convince a user to run a script to fix an issue, to distribute HTA scripts. These scripts downloaded trojanized installers disguised as common tools such as Zoom, WebEx, MobaXterm, DBeaver, and FaceIT.

The third technique described abuse of Chrome Sync. With only brief physical access to an unlocked phone, an attacker can add their own Google account to Chrome and enable Sync, after which the victim's browsing activity is copied to the attacker's account in the background, viewable at any time.

Why these approaches succeeded

Each technique exploited a different form of trust:

• The investment scam relied on sustained personal contact to build a bond before asking for larger sums.
• The fake platform looked indistinguishable from a real investment dashboard, removing an obvious visual red flag.
• The ClickFix lures used familiar, trusted software names to make a malicious download path feel routine.
• Chrome Sync abuse required no malware at all, just a few seconds of unsupervised device access and a legitimate feature working as designed.

What to watch for

• Unsolicited outreach from someone claiming to be a financial advisor, especially if contact continues over weeks or months.
• Pressure to deposit more money based on “profits” shown on a platform that cannot be independently verified.
• Requests to pay via cryptocurrency.
• Unexpected prompts to run a script or installer to “fix” a problem, particularly outside the official vendor’s download path.
• Unfamiliar Google accounts appearing in Chrome, or sync settings that were enabled without the user’s action.

Building resistance

Organizations and individuals can reduce exposure by verifying investment opportunities independently before depositing funds, treating “fix it now” prompts with suspicion unless they originate from the official vendor, and locking devices while periodically reviewing browser accounts and sync settings for anything unexpected. These habits address the trust-based mechanics behind each technique described here, rather than relying solely on technical detection.

How does the fake financial advisor scam work?

Callers pose as financial advisors and build trust over months, encouraging victims to start with a small deposit that shows an immediate profit, then push for increasingly larger deposits, often paid in cryptocurrency.

What is a ClickFix lure?

A ClickFix lure convinces a user to run a script or installer to fix a problem, but it actually downloads a trojanized installer disguised as common software like Zoom, WebEx, or MobaXterm.

Can someone really spy on my browsing through Chrome Sync?

Yes, if someone gets brief physical access to an unlocked phone, they can add their own Google account to Chrome and enable Sync, which copies browsing activity to their account in the background.

How can I tell if an investment platform is fake?

Fake platforms can look identical to real ones and show fabricated profits, so the takeaway is to independently verify the firm rather than trusting the dashboard's appearance.