ClickFix Evolves: Hackers Abuse Google Sheets API for Browser-Based Crypto Wallet Theft

Cisco Talos has uncovered a months-long cryptocurrency-theft campaign that weaponizes a decade-old Google feature to run command-and-control operations from inside victims’ own browsers, marking a significant evolution of the “ClickFix” social engineering playbook.

Traditional ClickFix attacks trick users into pasting PowerShell commands to infect their operating system.

This campaign flips that model entirely: instead of targeting the machine, attackers convince victims to inject malicious JavaScript directly into their own Chrome session, either by pasting a javascript: snippet into the address bar or installing it via the legitimate Tampermonkey browser extension, which also delivers persistence across future visits.

ClickFix Evolves: Hackers Abuse Google Sheets API

The lure is a fabricated “leaked vulnerability report” describing a nonexistent API flaw in cryptocurrency swap platforms like SwapZone.io and, later, SimpleSwap.io.

It promises technically curious and ethically flexible users outsized trading bonuses (up to 38%, then 25%) if they exploit the “flaw” themselves. Distribution channels included Telegram, DarkForums, and paste sites, with new lure batches pushed out roughly twice monthly since campaign activity began in October 2025.

The technical centerpiece is abuse of the Google Visualization API, a largely forgotten 2008-era feature that grants free, unauthenticated read access to any publicly published Google Sheets document via SQL-like URI queries.

Starting in March 2026, attackers began storing obfuscated second-stage JavaScript payloads inside spreadsheet cells, retrieving them through Visualization API calls that blend into legitimate docs.google[.]com traffic security tools rarely flag as suspicious.

To evade casual inspection, attackers formatted malicious payload text white-on-white within the sheet, periodically shifting the hidden rows further down as they added new payload versions.

Talos extracted 21 unique obfuscated payload samples, most of which used XOR-encoded hex arrays with rotating keys generated through tools like Obfuscator.io.

Once injected, the payload functions as a full browser-based web skimmer. It hooks the fetch API to intercept and rewrite JSON responses containing deposit addresses, hijacks the clipboard to swap copied wallet addresses for attacker-controlled ones, and uses MutationObserver to render fake “bonus” UI elements that persist through page updates.

A rotating pool of Bitcoin Bech32 addresses was embedded for substitution.

“This campaign is less notable for who it victimized than for what it proves is possible. The line between ‘legitimate service abuse’ for espionage C2 and consumer-facing financial fraud has effectively disappeared and the same technique that steals a few thousand dollars from would-be scammers today could just as easily be repurposed against a Fortune 500 e-commerce checkout page tomorrow.”

Talos traced 49 BTC wallets tied to the operation; 24 of an initial 30 received roughly 0.159 BTC (~$10,000 at early-August 2026 valuations), with funds subsequently laundered through over 3,000 addresses via apparent mixing services.

Despite reports to Google and the targeted platforms prompting takedowns in April, the actors resurfaced within a week using fresh spreadsheets and paste[.]sh links and remained active as of mid-August.

Talos warns the real danger lies in transferability: paired with supply-chain access sold by groups like TeamPCP, similar Google-hosted injection techniques could scale far beyond opportunistic crypto scams into Magecart-style attacks on mainstream e-commerce and enterprise web applications.

Recommended defenses include restricting browser extension deployment by role, monitoring anomalous docs.google[.]com traffic from non-Google-Docs contexts, and routine sanitization of third-party web dependencies.

Site: Thecyberdef.com

Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.