Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency

A cryptocurrency-stealing campaign that abuses Google Sheets and the Google Visualization API as a covert command-and-control channel, delivering obfuscated JavaScript directly into victims’ browser sessions.

The operation marks a significant evolution of ClickFix social engineering: rather than persuading users to execute PowerShell commands or install malware on an operating system, attackers manipulate them into running malicious code inside Chrome itself.

The document claims to disclose a nonexistent API weakness affecting cryptocurrency swap platforms and promises victims inflated returns if they exploit the purported flaw.

The actual outcome is the silent replacement of victims’ cryptocurrency deposit addresses with wallets controlled by the attackers.

Cisco Talos observed the lures spread through Telegram channels, DarkForums private messages and posts, Pastebin comments, and other text-sharing platforms.

The victim profile is unusually specific: individuals active in cryptocurrency, software-development, cybersecurity, and hacking communities who may be tempted by a supposed low-effort method to profit from a trading-platform vulnerability.

This social engineering premise is particularly effective because it disguises fraud as an opportunity to exploit fraud.

Traditional ClickFix attacks use fake CAPTCHAs, error messages, or verification prompts to convince users to copy commands into Windows Run, PowerShell, Terminal, or a similar execution interface. In this case, the attacker-controlled code executes within the browser context.

In the campaign’s early stage, victims were instructed to copy a JavaScript snippet, prepend javascript:, and paste it into Chrome’s address bar while visiting the targeted exchange service.

This causes the browser to execute the code in the security context of the active site.

Later campaign variants changed the delivery method. Victims were directed to install the legitimate Tampermonkey browser extension and add a supplied user script.

This variation is more dangerous because Tampermonkey loads the malicious script automatically each time the victim visits the targeted cryptocurrency site, creating persistence without malware installation or traditional endpoint compromise.

The first-stage loader contacts a publicly published Google Sheet through the Google Visualization API.

Cisco Talos Researchers said that, the campaign targets cryptocurrency users through a fake “leaked vulnerability report” titled “API Logic Flaw.”

Introduced in 2008, the API can return data from public spreadsheets as JSON or HTML through docs.google.com requests, enabling the attackers to hide payload retrieval inside trusted Google HTTPS traffic.

Google Sheets C2 Abuse

The malicious loader retrieves two spreadsheet cells containing obfuscated JavaScript, combines them, and injects the reconstructed second-stage payload into the cryptocurrency site.

Early lures claimed victims could obtain approximately 38% higher payouts on SwapZone transactions, while later versions advertised a 25% “loyalty bonus” against SimpleSwap.

Talos found the operators concealed the payload text using white-on-white formatting and pushed the hidden rows deeper into the spreadsheet to frustrate casual inspection.

The actors also changed spreadsheet references and queried cells after disruption attempts, giving them a flexible and low-cost delivery infrastructure.

This abuse is notable because browser-originated traffic to docs.google.com can appear routine.

Conventional detection methods often focus on unusual processes communicating with cloud services; here, malicious requests originate from a legitimate browser during an otherwise valid browsing session.

The injected payload behaves as a browser-based web skimmer. It uses DOM manipulation and MutationObserver logic to monitor cryptocurrency transaction pages and alter visible deposit addresses, transaction values, and interface elements.

Fake “bonus” components are displayed to reinforce the lure and conceal the fraud.

The malware also overrides the browser’s fetch API, allowing it to inspect and modify responses associated with deposit-address or wallet endpoints.

When the targeted site returns a legitimate cryptocurrency deposit address, the script substitutes an attacker-controlled Bitcoin address before the victim sees or uses it.

Clipboard hijacking adds another theft path. When the victim copies a displayed wallet address, the script replaces clipboard content with a randomly selected attacker wallet.

This means victims may unknowingly transfer funds to criminal-controlled addresses even if they manually copy and verify the address from the site interface.

Talos identified 49 Bitcoin wallet addresses associated with the campaign. Of the 30 addresses reused across many recovered samples, 24 received victim funds totaling 0.159 BTC, worth roughly $10,000 at early-August 2026 Bitcoin valuations.

Researchers also tracked subsequent movement through 30 additional wallets and more than 3,000 addresses, behavior consistent with mixing intended to obscure the final destination of the stolen cryptocurrency.

The campaign primarily targets individual cryptocurrency users, but its methods have broader implications.

The combination of trusted-service abuse, browser-session injection, extension-based persistence, API interception, and UI manipulation could be repurposed against e-commerce checkout pages, SaaS portals, payment systems, or software supply-chain targets.

Organizations should restrict unmanaged browser extensions, monitor unexpected Google Visualization API calls especially docs.google.com/spreadsheets/…/gviz/tq traffic unrelated to normal business activity and educate users never to paste code into the browser address bar, developer console, or extension configuration pages.

Security teams should also inspect web applications and third-party JavaScript dependencies for unexpected obfuscation, overridden fetch functions, wallet-address manipulation, and suspicious clipboard-handling routines.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.