ClickFix Moves into the Browser to Steal Cryptocurrency

A ClickFix campaign has shifted from tricking users into running commands on their computers to persuading them to inject malicious JavaScript into their own browsers, in a scheme aimed at people willing to commit fraud.

Cisco Talos said in research published September 8 that the months-long campaign used the Google Visualization API to retrieve obfuscated code from a public Google Sheets document and inject it into sessions on two cryptocurrency trading sites.

The operation has survived two disruption attempts. Talos alerted Google and the targeted sites in April, and the campaign returned a week later on a new spreadsheet; as of August 11 the replacement Google documents had been reported again but remained live.

ClickFix Moves From the OS to the Browser

The campaign began in October 2025 with lures instructing targets to paste JavaScript into Chrome's navigation bar. The operators added the Visualization API in March 2026 and, from mid-April, told victims to install the Tampermonkey browser extension before adding a script.

The lures posed as leaked vulnerability reports describing non-existent API flaws at cryptocurrency swap services, promising payouts up to 38% higher. Talos said the appeal was to readers prepared to exploit a flaw they did not understand.

Talos found the material on Telegram, the cybercrime forum DarkForums and text-sharing sites, with waves of messages sent at least twice a month.

Read more on ClickFix: ClickFix Now Cybercriminals' Favorite Malware Delivery Technique

The Visualization API gives free, unauthenticated read-only access to any Google Sheets document published to the web, so the request came from the victim's own browser and resembled ordinary web traffic. The operators hid the payload cells by formatting the text white on white.

Talos collected 21 second-stage payloads from the spreadsheet, rotated with fresh XOR keys and randomized variable names but functionally unchanged.

Injected Scripts Turn Browser Into Crypto Skimmer

The scripts monitored page changes, replaced displayed deposit addresses and altered transaction amounts to suggest a bonus had been applied. They also overrode the browser's fetch API, substituting attacker wallet addresses into deposit responses before the data reached the page.

A clipboard function replaced any address the victim copied. On the Tampermonkey version, the code reloaded on every visit to the targeted site.

Talos identified 49 Bitcoin addresses across the campaign. Most samples it decoded, covering April to late June, drew on one set of 30, of which 24 received victim funds totaling 0.159 BTC, about $10,000 at early August valuations.

The researchers said the real figure was probably higher, and that proceeds were routed through 30 further wallets and then more than 3000 addresses in what looked like a mixing operation.

Talos said the campaign posed no specific threat to most organizations but that the techniques did, and advised restricting browser extensions by role and monitoring browser sessions for requests to Google Docs.