ClickFix Variant Leverages Google API for Crypto Theft

ClickFix Variant Leverages Google API for In-Browser Cryptocurrency Theft

Cisco Talos has identified a novel cryptocurrency-stealing campaign, dubbed a variation of ‘ClickFix’ social engineering, that has shifted its focus from operating system compromise to direct browser session manipulation. This campaign uniquely abuses the Google Visualization API for command and control (C2), delivering obfuscated JavaScript from publicly published Google Sheets documents directly into victims’ browsers. The ultimate goal is to facilitate cryptocurrency theft by altering deposit addresses and manipulating user interfaces, as detailed by Cisco Talos.

This threat is significant not just for its immediate impact on targeted individuals but also for demonstrating how widely trusted legitimate services can be weaponized. While the current campaign targets a niche demographic, the underlying techniques pose a broader risk, especially concerning potential future supply-chain attacks on e-commerce and other customer-facing web platforms.

Technical Analysis of Browser-Based ClickFix Attacks

Unlike traditional ClickFix attacks that coerce users into executing PowerShell or other commands on their operating systems, this variant convinces targets to paste malicious JavaScript directly into their Chrome address bar or install it via the Tampermonkey browser extension. Tampermonkey, a legitimate user script manager, is specifically leveraged to inject a loader script and provide persistence across browser sessions.

Since March 2026 (an early version started in October 2025), the criminal actors behind this campaign began utilizing the Google Visualization API. This API, typically used for rendering data from Google Sheets, offers unauthenticated read-only access to publicly published spreadsheets. The attackers embed queries within URIs to retrieve specific cells containing obfuscated JavaScript. This method allows for a highly flexible and resilient C2 infrastructure, as the malicious scripts are hosted on trusted Google domains, making detection challenging for traditional network monitoring tools.

Once injected, the script acts as a web skimmer. Its primary functions include:

• Intercepting API Calls: It hooks the browser’s fetch API to monitor and modify server responses.
• Address Replacement: Dynamically replaces cryptocurrency deposit addresses displayed on targeted swap services and within the user’s clipboard.
• User Interface Manipulation: Displays counterfeit “bonus” interface elements to trick victims into believing they are receiving additional funds, further encouraging illicit transactions.

Talos observed the social engineering lures distributed through platforms like Telegram, DarkForums, and paste sites. These lures are crafted to appeal to individuals interested in exploiting a non-existent API vulnerability on cryptocurrency swap services, promising them easy financial gain. This ‘phishing for sharks’ approach targets users willing to engage in fraudulent activities themselves.

Detecting ClickFix Browser Injection via Google API C2

Mitigating Google Visualization API abuse for C2 and securing against this type of browser injection requires a multi-layered approach. The reliance on legitimate Google services for C2 makes traditional perimeter defenses less effective, as traffic blends with benign activity. Security professionals investigating Tampermonkey malicious script detection and similar browser-based threats should prioritize user education and endpoint monitoring.

Organizations and individuals, especially those interacting with cryptocurrency platforms, should be aware that while the immediate targets are specific, the techniques employed are highly adaptable. Monitoring browser extension installations, scrutinizing scripts pasted into developer consoles, and maintaining vigilance against social engineering ploys are crucial.

Actionable Recommendations for Defenders

To protect against campaigns like the browser-based ClickFix variant, defenders should focus on the following:

• User Education: Conduct training to raise awareness about social engineering tactics. Emphasize the dangers of pasting untrusted code into browser consoles or installing unverified browser extensions, even if they appear to promise illicit gains.
• Browser Security Policies: Implement and enforce strict browser security policies. This includes restricting arbitrary script execution, managing approved browser extensions, and regularly auditing installed extensions.
• Endpoint Detection and Response (EDR): Utilize EDR solutions that can monitor browser process activity, detect unusual script injections, or identify unauthorized modifications to web content within a browser session.
• Network Traffic Analysis: While challenging, look for anomalous traffic patterns to legitimate cloud services. Specifically, monitor for large volumes of requests to Google Sheets or Google Docs from unexpected processes or user agents, though browser-initiated requests will be harder to flag.
• Cryptocurrency Transaction Verification: For users and organizations handling cryptocurrency, always verify deposit addresses through independent means before finalizing transactions. Do not rely solely on addresses displayed in the browser or copied from the clipboard.

Related: TELEPUZ Malware: Analyzing Modular Payloads in ClickFix Campaigns, BlueNoroff Zoom Phishing Kit Targets Crypto Wallets