ClickFix crypto-theft campaign abuses Google Sheets C2 and Tampermonkey persistence to skim Bitcoin deposits in Chrome

Cisco Talos is tracking a ClickFix campaign that delivers a browser-based web skimmer via JavaScript pasted into Chrome or installed in Tampermonkey, with C2 hidden in Google Visualization API traffic; at least ~0.159 BTC (~$10,000) has been stolen across 24…

Cisco Talos is tracking a cryptocurrency-theft campaign that uses ClickFix-style social engineering to trick targets into pasting attacker-controlled JavaScript into Chrome, either into the address bar or by installing it as a Tampermonkey user script, injecting a browser-based web skimmer into sessions on two cryptocurrency trading sites. Per Infosecurity Magazine, the campaign began in October 2025 and shifted from traditional OS command execution to browser JavaScript injection. The lures pose as a leaked report of a nonexistent API flaw at cryptocurrency swap services, promising 25-38% bonuses on SimpleSwap and SwapZone swaps (per GBHackers; Infosecurity describes payouts up to 38% higher), and have spread via Telegram, DarkForums, and paste sites (identified as Pastebin by GBHackers) since early October 2025. The targeted sites are not named in the Talos report but are identified as SimpleSwap and SwapZone in follow-up coverage by GBHackers and Cyber Security News. Since March 2026 the campaign has retrieved obfuscated JavaScript from cells in public Google Sheets documents via the Google Visualization API, concealing the C2 channel inside trusted HTTPS traffic to Google; Infosecurity reports Tampermonkey usage has been tracked since April 2026. The payload acts as a web skimmer: it hooks and overrides the fetch API and rewrites cryptocurrency deposit addresses on screen, in web responses, and in the clipboard, and per Infosecurity it also inflates displayed amounts. A Tampermonkey variant re-injects the payload on every return visit, providing persistence across sessions without OS-level compromise; the campaign survived two disruption attempts. Talos identified 49 attacker-controlled Bitcoin addresses, of which 24 reused addresses received a combined ~0.159 BTC (roughly $10,000) by early August 2026; GBHackers and Infosecurity describe this as an observed floor, with proceeds mixed through roughly 30 wallets and more than 3,000 addresses in apparent mixing. Talos warns the legitimate-service-abuse techniques could be repurposed for wider supply-chain attacks on e-commerce and customer-facing systems, and recommends role-based extension restrictions and browser monitoring.

• Campaign began early October 2025 and shifted from OS command execution to browser JavaScript injection (Infosecurity Magazine)
• Lures fake a leaked report of a nonexistent API flaw at crypto swap services, promising 25-38% bonuses on SimpleSwap and SwapZone swaps; spread via Telegram, DarkForums, and paste sites (Pastebin per GBHackers)
• Since March 2026, obfuscated JavaScript is fetched from public Google Sheets cells via the Google Visualization API, hiding C2 in trusted HTTPS traffic; Tampermonkey usage tracked from April 2026 (Infosecurity)
• Skimmer overrides the fetch API and swaps deposit addresses on screen, in web responses, and in the clipboard; also inflates displayed amounts (Infosecurity)
• Tampermonkey variant re-injects the payload on return visits, giving persistence without OS-level compromise; campaign survived two disruption attempts (Infosecurity)
• 49 Bitcoin addresses identified; 24 reused addresses received at least ~0.159 BTC (~$10,000) by early August 2026, likely more per Infosecurity
• Proceeds were mixed through roughly 30 wallets and more than 3,000 addresses in apparent mixing (Infosecurity; 3,000+ addresses also per GBHackers)
• Targeted trading sites are unnamed in the Talos report; GBHackers and Cyber Security News identify them as SimpleSwap and SwapZone