ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
Cisco Talos has uncovered a sophisticated cryptocurrency theft campaign leveraging Google Visualization API abuse. The attackers, using a variation of the ClickFix social engineering tactic, are injecting malicious JavaScript into users' browser sessions to steal cryptocurrency deposits. They initially used a fake vulnerability report targeting cryptocurrency swap services, but have since moved to using a Google Docs/Sheets-hosted payload delivered through the Tampermonkey browser extension. The campaign has targeted users on various forums and exchanges, and involves multiple iterations of lures and payloads to evade detection.
Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session. This campaign uses a twist on what we refer to as “legitimate service abuse,” utilizing Google’s services to deliver malicious code.
This campaign employs tactics associated with “ClickFix” social engineering attacks, where targets are manipulated into copying and pasting PowerShell or other commands to launch malware. Instead of targeting the victim device’s OS, the actors behind this campaign aim to convince the user to inject malicious code into their own browser session. Early versions of this campaign began in early October 2025, with initial lures focusing on getting targets to paste a code snippet directly into the Chrome web browser’s navigation bar. The latest version relies on a legitimate Chrome plugin, Tampermonkey, to inject a loader script pasted in by the user and provide persistence across sessions with the current targeted site.
In March 2026, the actors behind the campaign began using the Google Visualization API to deliver malicious scripts stored in a Google Sheets document. In July, after frequent disruption of their posts on shared text sites, the actors moved to hosting all the components of their campaign in Google Docs and Google Sheets. So far, the actors behind this scheme have largely targeted individuals who frequent web discussion boards and forums focused on cryptocurrency trading, software development, basic cybersecurity, and hacking.
The lure used in the campaign is designed to appeal mostly to would-be cybercriminals looking to make a quick profit off an “API vulnerability” that doesn’t exist to get bigger payouts on cryptocurrency trades. The initial version targeted the cryptocurrency trading site “SwapZone[.]io,” claiming a flaw in an older version of the ChangeNOW cryptocurrency exchange’s API. The actors instructed users to copy a script from a “paste[.]sh” link and paste it into Chrome’s navigation bar preceded by “javascript:”.
On April 18, Talos observed a new revision of the lure document. The new lure used the same “docs.google[.]com” URL as the previous lure but was rewritten to target a different trading site — “SimpleSwap[.]io”, another cryptocurrency trading aggregator. The fake exploit this time was a flaw in a “loyalty bonus” function that allegedly triggered a 25% boost in the value of the trade, according to the updated lure document. The actors instructed users to install the Tampermonkey browser extension to activate the “bonus.”
Both versions of the campaign’s first-stage loader script contained strings that did essentially the same thing: They both connected to the same Google-hosted spreadsheet via the Visualization API, retrieving blocks of code from different pairs of cells within the sheet. The initial version of the script depended on direct user execution of the script within Chrome. Targets were instructed by the lure to copy the script from the “paste[.]sh” URL and paste it into Chrome’s navigation bar preceded by “javascript:”. The address of the Google Docs spreadsheet is plainly visible in the sample, and the JavaScript containing it swaps it for the fictitious vulnerable API’s URL to construct the Visualization API URL to retrieve the second stage script from.
Over the course of our investigation, Talos saw the actors behind this campaign change the the payload delivered by the first stage script multiple times, which all did essentially the same thing: They decoded JavaScript code to inject into the targeted web pages to create the “exploits” they used to steal Bitcoin from victims. The actors used multiple lures and payloads to evade detection. The campaign involved a complex process of retrieving JavaScript code from Google Sheets and injecting it into targeted web pages, utilizing Tampermonkey for persistence and obfuscation.