ClickFix Moves into the Browser to Steal Cryptocurrency
Cisco Talos details a ClickFix campaign injecting browser JavaScript via Google Sheets to skim crypto deposits, stealing at least ~0.159 BTC since October 2025
48
Product
Tampermonkey
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 8, 2026
- Last mentionedSep 9, 2026
Timeline
3 articles · newest firstHackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency
Cisco Talos tracks a ClickFix crypto-theft campaign using Google Sheets as C2 to swap deposit addresses in Chrome.
52
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
Talos tracks a crypto-theft campaign abusing the Google Visualization API for C2, using browser-based ClickFix lures to inject web-skimmer JavaScript.
48
Appears with
- Google Visualization APIproduct · 3
- Googlevendor · 3
- Cisco Talosorganization · 2
- Google Sheetsproduct · 2
- Chromeproduct · 2
- browser-based web skimmermalware · 1
- Cisco Talosvendor · 1
- cryptocurrency trading site usersvictim · 1
- SimpleSwaporganization · 1
- DarkForumsorganization · 1
- SwapZoneorganization · 1
- cryptocurrency usersvictim · 1
- Ciscovendor · 1
- browser-injected JavaScript skimmermalware · 1
- ClickFix operatorsthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.