Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency
Cisco Talos tracks a ClickFix crypto-theft campaign using Google Sheets as C2 to swap deposit addresses in Chrome.
Cisco Talos uncovered a cryptocurrency theft campaign that abuses Google Sheets and the Google Visualization API as a covert C2 channel, delivering obfuscated JavaScript into victims' Chrome browser sessions via ClickFix-style social engineering. Victims are lured with a fake "API Logic Flaw" report promising 25-38% bonuses on SimpleSwap and SwapZone swaps; the injected payload acts as a browser-based web skimmer that replaces deposit addresses, overrides the fetch API, and hijacks the clipboard. Later variants use the legitimate Tampermonkey extension with a user script for persistence without OS-level compromise. Talos identified 49 Bitcoin wallets, with 24 reused addresses receiving about 0.159 BTC (~$10,000) before mixing through more than 3,000 addresses.
- Google Sheets and Visualization API serve as C2 hidden in trusted HTTPS traffic
- Payload swaps crypto deposit addresses and hijacks clipboard contents
- Tampermonkey user script provides persistence without traditional endpoint compromise
- ~0.159 BTC (~$10,000) observed across 24 reused wallet addresses
- Lures spread via Telegram, DarkForums, and Pastebin channels
- ATT&CK
- T1059.007 JavaScript/JScriptT1071.001 Web ProtocolsT1115 Clipboard DataT1176 Browser Extensions
- Vendors
- Malware
- browser-based web skimmer
- Victims
- cryptocurrency users
- Organizations
- Cisco TalosSimpleSwapSwapZone
From the original article
4 min read at gbhackers.com
A cryptocurrency-stealing campaign that abuses Google Sheets and the Google Visualization API as a covert command-and-control channel, delivering obfuscated JavaScript directly into victims’ browser sessions.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.