1. Basic Information Article Title: ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2 Publisher: Cisco Talos Publication Date: 2026-09-08 Original Source: Cisco Talos Related Sources: Dark Reading: ClickFix Campaigns Abuse Legitimate Services Related Malware, Groups, CVEs, and Products: Browser web skimmer, Google Sheets, Google Visualization API, Google Docs, Google Chrome, Tampermonkey Priority: High 2. Executive Summary Attackers use fake cryptocurrency API vulnerability claims to persuade users to paste JavaScript, establish persistence through Tampermonkey, and replace deposit addresses and clipboard contents using scripts retrieved through the Google Visualization API. 3. Attack Flow Browser-based ClickFix: Google Sheets C2 and Tampermonkey transaction manipulation An attacker distributes a fake “cryptocurrency service API vulnerability report” through forums, Telegram, and similar channels. Users seeking profit follow instructions to paste JavaScript into Chrome’s address bar or Tampermonkey. A loader retrieves obfuscated scripts from public Google Sheets through the Google Visualization API. In the browser, it hooks fetch and the clipboard and replaces deposit addresses and displayed content. When the user transfers funds on the legitimate service, the assets are sent to the attacker’s address. 4. Attacker Position and Execution Environment An attacker able to distribute lures on cryptocurrency forums, Telegram, and similar platforms. An attacker persuading users to inject code into their own browser sessions. 5. What Users and Administrators May See Users The use of legitimate cryptocurrency sites and Google domains makes the activity appear normal, and users may transfer funds after trusting the displayed bonus or deposit address. Administrators Inference: Script retrieval may blend into normal browser traffic, while suspicious Tampermonkey userscripts or modified payment destinations may remain as evidence. 6. Success Conditions and Risk Reduction Success Conditions The user believes the promise of illicit profit and pastes the code. A browser extension or the page context injects the script into the targeted site. Retrieval of scripts from legitimate Google domains and replacement of cryptocurrency addresses go undetected. Failure Conditions and Risk Reduction Manage developer features and extensions such as Tampermonkey through role-based allowlists. Investigate script retrieval from public Sheets APIs by business browsers and userscripts running on targeted sites. Compare the destination with an address obtained through a separate trusted channel. Include the address displayed on a hardware wallet in that comparison; display on the device alone does not establish the correct destination. 7. Potential Impact Theft of cryptocurrency through replacement of deposit addresses and clipboard contents. Persistence across browser sessions, scoped to targeted sites. Detection evasion by using legitimate Google infrastructure for C2/payload delivery. 8. Observable Logs Inference: These are investigation sources and their collection requirements. Email: Where relevant emails exist, preserve the original messages, complete URLs, and delivery records. Proxy/SWG/DNS: Where URL visibility is available through TLS inspection or equivalent collection, investigate /gviz/tq and the target document ID. DNS logs alone cannot identify the sheet or retrieved contents. Endpoint/EDR: Inspect browser profiles and extension storage for Tampermonkey installation and suspicious userscripts. Confirming paste actions, DOM changes, or fetch hooks requires additional investigation inside the browser. Identity/IdP: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval. SaaS/Cloud: For cloud deployments, review audit records for workloads, IAM, and API operations. Network: A connection to Google alone does not establish maliciousness. Correlate destination-address manipulation with browser evidence and transaction records. 9. Assessing Attack Success The following are evidence criteria for an individual investigation. See Facts and Unknowns for the scope of actual observations. Attempt observed (success unconfirmed): Evidence criterion: Confirm contact with lure URLs, Google Docs, or forum posts. User interaction confirmed: Evidence criterion: Confirm that the user pasted JavaScript or installed Tampermonkey. Initial execution confirmed: Evidence criterion: Confirm retrieval of the loader from Google Sheets and injection into the browser. Malware execution or authentication success confirmed: Evidence criterion: Confirm fetch or clipboard hooks and address replacement. Data theft or session compromise confirmed: Evidence criterion: Confirm a transaction to the attacker’s address. Follow-on compromise confirmed: Evidence criterion: Confirm deployment of the same extension or script to other browsers or accounts. 10. Investigation Playbook Inference: Operational recommendations based on publicly described behavior. Trigger: A suspicious userscript or a report of a modified payment destination. Initial Checks: Identify the affected host, user, and time, and preserve relevant logs and configuration. For vulnerability incidents, verify the actual version and exposure. Endpoint: Inspect browser profiles and extension storage for Tampermonkey installation and suspicious userscripts. Confirming paste actions, DOM changes, or fetch hooks requires additional investigation inside the browser. Identity and Cloud: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval. For cloud deployments, review audit records for workloads, IAM, and API operations. Follow-on Activity: A connection to Google alone does not establish maliciousness. Correlate destination-address manipulation with browser evidence and transaction records. Containment: Stop transactions in the suspected browser, and preserve the profile, userscripts, and transaction records. Remove malicious scripts and review affected transactions from a trusted environment. Classification: These success criteria are for investigations. Distinguish evidence confirmed in the individual environment from publicly reported observations. 11. Defense and Detection Ideas Inference: Operational recommendations based on publicly described behavior. Single Event: A suspicious userscript or a report of a modified payment destination. Time-Series Correlation: Correlate user installation and execution of scripts, retrieval from Sheets, destination-address changes, and actual transactions. Threat Hunting: Where URL visibility is available through TLS inspection or equivalent collection, investigate /gviz/tq and the target document ID. DNS logs alone cannot identify the sheet or retrieved contents. A connection to Google alone does not establish maliciousness. Correlate destination-address manipulation with browser evidence and transaction records. Logging Gaps: Check retention periods and collection settings. DNS alone does not reveal URL paths, and ordinary network logs do not reveal endpoint-local activity. Missing records do not prove an absence of compromise. Priority Controls: Manage developer features and extensions such as Tampermonkey through role-based allowlists. 12. Facts / Inference / Hypothesis Facts Talos tracked a cryptocurrency-theft campaign active since around October 2025 and published its analysis on September 8, 2026. The lures falsely promised profits from exploiting a nonexistent cryptocurrency exchange API vulnerability and circulated through Telegram, DarkForums, text-sharing sites, and similar channels. Users are directed to paste JavaScript into Chrome’s address bar or install a loader script in Tampermonkey. The latter provides persistence across sessions on targeted sites. The loader uses the Google Visualization API to retrieve obfuscated JavaScript from cells in public Google Sheets and injects it into the browser session. The script hooks the fetch API, replaces deposit addresses in server responses and clipboard contents with attacker addresses, and displays a fake bonus interface. Inference The investigation, detection, and mitigation recommendations are based on publicly described behavior. Their applicability depends on each environment’s collection settings, privileges, and traffic visibility. Hypothesis No additional hypotheses. Unresolved points are listed under Unknowns and Further Investigation. 13. MITRE ATT&CK Mapping T1204.004 User Execution: Malicious Copy and Paste (high confidence): Users are persuaded to paste JavaScript into the browser. T1176.001 Software Extensions: Browser Extensions (high confidence): Tampermonkey makes site-specific scripts persistent. 14. Unknowns and Further Investigation The actual amount stolen and number of victims. Campaign operator identity and the full set of attacker wallets. Whether the approach has been repurposed against enterprise environments. Bidirectional C2 through Google Sheets is not described as observed. The original article’s use of Google Forms for data transmission is a generic architectural example. 15. Impact on SOCs and Organizations Organizations should manage browsers as execution environments, not merely web viewers. Monitor extension permissions, content scripts, public Sheets API traffic, and clipboard manipulation, and independently verify payment destinations in cryptocurrency, payment, and administrative portals. 16. Audience Summaries SOC: Correlate user installation and execution of scripts, retrieval from Sheets, destination-address changes, and actual transactions. Administrators: Manage developer features and extensions such as Tampermonkey through role-based allowlists. Users: The use of legitimate cryptocurrency sites and Google domains makes the activity appear normal, and users may transfer funds after trusting the displayed bonus or deposit address.