Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks
Cisco Talos details a crypto-theft ClickFix campaign abusing Google Sheets to swap wallet addresses, with about $10,000 in observed Bitcoin losses.
Cisco Talos tracks a ClickFix-style campaign that tricks cryptocurrency traders into pasting JavaScript into Chrome's address bar or a Tampermonkey extension, promising fake bonuses on SwapZone and SimpleSwap. The loader pulls obfuscated JavaScript from cells in a public Google Sheet via the Visualization API, then behaves like a web skimmer, rewriting deposit addresses on screen, in web responses, and in the clipboard. Researchers counted 49 attacker-controlled Bitcoin addresses, with 24 receiving a combined 0.159 BTC, roughly $10,000, by early August 2026. A Tampermonkey variant re-injects the payload on every return visit, giving the attackers persistence despite takedown efforts.
- ClickFix lures promise fake API flaws and loyalty bonuses on SwapZone and SimpleSwap crypto exchanges
- Loader fetches obfuscated JavaScript from public Google Sheets cells via the Visualization API
- Payload swaps deposit addresses on screen, in web responses, and in the clipboard
- Tampermonkey extension variant persists and re-injects the payload on return visits
- 49 Bitcoin addresses tracked; 24 received 0.159 BTC, about $10,000
- Tags
- cisco-talosclickfixclipboard-hijackingcrypto-theftgoogle-sheetssocial-engineeringtampermonkeyweb-skimmer
- Products
- Google SheetsSwapZoneSimpleSwap
- Malware
- ClickFix
- Victims
- cryptocurrency traders
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | obfuscator.io | or the fraudulent Google Docs lure document Tool or service Obfuscator[.]io JavaScript obfuscation service whose output patterns were |
| domain | paste.sh | and payload retrieval through the Visualization API Domain paste[.]sh Hosted first-stage JavaScript loader scripts used in the |
| domain | simpleswap.io | cy trading site targeted by the initial lure version Domain SimpleSwap[.]io Cryptocurrency trading site targeted by the later Tamperm |
| domain | swapzone.io | RL promoted for the Tampermonkey-based loader script Domain SwapZone[.]io Cryptocurrency trading site targeted by the initial lure |
From the original article
4 min read at cybersecuritynews.com
Hackers are using Google Sheets as an unlikely control channel in a cryptocurrency theft campaign. The operation turns a familiar browser session into a place where malicious code runs, rather than placing a conventional program on a victim’s computer. The attackers promote a fake report claiming to expose profitable flaws at cryptocurrency swap services.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.