Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks

Hackers are using Google Sheets as an unlikely control channel in a cryptocurrency theft campaign. The operation turns a familiar browser session into a place where malicious code runs, rather than placing a conventional program on a victim’s computer.

The attackers promote a fake report claiming to expose profitable flaws at cryptocurrency swap services. Victims are told to paste JavaScript into Chrome’s address bar or add it to a browser extension, allowing the code to run on the trading site they are visiting.

The campaign began with ClickFix-style lures in October 2025 and adopted Google’s Visualization API in March 2026.

The researchers found messages on Telegram, DarkForums, email, and paste sites, targeting people interested in trading, coding, hacking, and quick financial gains. The result is a wallet-address swap at the moment a user expects to make a deposit.

Cisco Talos said in a report shared with Cyber Security News (CSN) that they identified 49 Bitcoin addresses used by the operation; 24 received a combined 0.159 BTC, valued at about $10,000 in early August 2026, although the actual total may be higher.

Hackers Abuse Google Sheets

This campaign changes the familiar ClickFix formula. Instead of asking a user to open Run or a terminal, the lure asks them to alter their browser. Requests for the next attack stage can therefore look like normal traffic to a trusted Google service.

The first lure described a fabricated API flaw that supposedly delivered around 38 percent higher payouts on SwapZone. A later version claimed a SimpleSwap loyalty feature could provide a 25 percent bonus, then instructed users to install Tampermonkey and paste in a loader script.

That evolution echoes how recent ClickFix delivery campaigns rely on a person to complete the dangerous action.

Here, the loader retrieves hidden, scrambled JavaScript from cells in a publicly published Google Sheet using the Visualization API, joins the code together, and injects it into the active page.

The malicious code behaves like a web skimmer. It watches the transaction page, changes displayed deposit addresses, intercepts web responses that contain wallet data, and replaces copied addresses in the clipboard with an attacker-controlled alternative.

It also adds false bonus information to make a transaction seem more attractive. The extension-based version gives the attackers an added advantage: persistence. Each time the target returns to the selected trading site, the loader can reconstruct and insert the payload again.

The operators also changed their Sheet and hosting setup after takedown efforts, making simple disruption short lived. The danger extends beyond cryptocurrency trading.

A compromised extension, web dependency, or customer-facing application could use similar browser-side tricks to quietly modify forms or information.

The abuse of recognized online services resembles trusted mirror ClickFix abuse, where a credible host can make a harmful page appear less suspicious.

Defending Against Browser-Based Lures

Users should treat any online claim of a secret trading bonus, exploit, or special API access as a warning sign. No website should require visitors to paste code into the address bar, developer console, terminal, or browser extension to unlock a legitimate feature.

This case also reinforces lessons from fake verification page attacks, in which a convincing prompt shifts execution to the victim. Before sending funds, users should compare the address shown on screen with the address copied to the clipboard and verify it through a trusted channel.

Organizations should control browser extensions by role and limit developer-level browser functions where they are not required.

Security teams should investigate unusual requests to Google Docs from browser sessions without normal document activity, especially after an employee visits untrusted forums or links.

Web application owners should test third-party code and remove unexplained, heavily obfuscated JavaScript. The campaign’s methods overlap with browser-based ClickFix techniques, but its public spreadsheet use shows why network trust alone is not enough to judge whether a web request is safe.

Training should focus on behavior, not just blocked domains. Employees and customers need clear guidance that copying code from a document, message, or trading “research” page can hand an attacker control of the browser session, even when the destination appears to be a well-known service.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Domain	docs.google[.]com	Google-hosted documents and Sheets were used for lure hosting and payload retrieval through the Visualization API
Domain	paste[.]sh	Hosted first-stage JavaScript loader scripts used in the campaign
URL	https[:]//paste[.]sh/dQfdExjo#AqjB4BBt]lwLt2NKrlC0x8J9O	Paste site URL promoted for the Tampermonkey-based loader script
Domain	SwapZone[.]io	Cryptocurrency trading site targeted by the initial lure version
Domain	SimpleSwap[.]io	Cryptocurrency trading site targeted by the later Tampermonkey-based lure
File name	API Logic Flaw	Name used for the fraudulent Google Docs lure document
Tool or service	Obfuscator[.]io	JavaScript obfuscation service whose output patterns were observed in payload samples

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.