Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency
Cisco Talos tracks a ClickFix crypto-theft campaign using Google Sheets as C2 to swap deposit addresses in Chrome.
52
Malware
browser-based web skimmer
- Mentions · 7d0
- Mentions · 30d0
- All mentions1
- First seenSep 9, 2026
- Last mentionedSep 9, 2026
Timeline
1 articles · newest firstAppears with
- Cisco Talosorganization · 1
- Google Visualization APIproduct · 1
- Chromeproduct · 1
- Tampermonkeyproduct · 1
- SwapZoneorganization · 1
- Googlevendor · 1
- Google Sheetsproduct · 1
- SimpleSwaporganization · 1
- cryptocurrency usersvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.