ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
Talos tracks a crypto-theft campaign abusing the Google Visualization API for C2, using browser-based ClickFix lures to inject web-skimmer JavaScript.
Criminal actors convinced targets to paste JavaScript into Chrome's address bar or install it in the Tampermonkey extension, injecting a web skimmer into sessions on two cryptocurrency trading websites; Tampermonkey also provides persistence. Since March 2026 the campaign retrieved obfuscated scripts via the Google Visualization API from public Google Sheets documents, hooking the fetch API and replacing cryptocurrency deposit addresses in responses and the clipboard. Lures pose as leaked reports of a nonexistent API flaw at cryptocurrency swap services and spread via Telegram, DarkForums, and paste sites since early October 2025. Talos warns the legitimate-service-abuse techniques could enable wider supply-chain attacks on e-commerce and customer-facing systems.
- Google Visualization API delivers C2 JavaScript from public Sheets documents
- Tampermonkey installation gives the skimmer persistence across sessions
- Web skimmer hooks fetch API and swaps cryptocurrency deposit addresses
- Lures fake a leaked vulnerability report at cryptocurrency swap services
- Techniques could be repurposed for supply-chain attacks on e-commerce sites
- Tags
- c2clickfixcryptocurrencygoogle-sheetsgoogle-visualization-apisocial-engineeringtampermonkeyweb-skimmer
- Vendors
- Cisco TalosGoogle
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | obfuscator.io | r variable and function names, consistent with output from “Obfuscator[.]io” and similar Javascript obfuscation tools. However, it wa |
| domain | paste.sh | to the lure document, was copy the script shared through a “paste[.]sh” link into the navigation bar of the Chrome browser prece |
| domain | simpleswap.io | ure but was rewritten to target a different trading site — “SimpleSwap[.]io”, another cryptocurrency trading aggregator. The fake exp |
| domain | swapzone.io | rsion we observed targeted the cryptocurrency trading site “SwapZone[.]io”. It was formatted in the style of a vulnerability report |
From the original article
14 min read at blog.talosintelligence.com
Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session.
By Sean Gallagher · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.