> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
- URL: https://f4n6.co.uk/security-feed/clickfix-moves-into-the-browser-cryptocurrency-theft-with-google-hosted-c2/
- Published: 2026-09-08T15:37:20.000Z
- Updated: 2026-09-08T15:37:20.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Cisco Talos documents a monthslong criminal campaign (active since early October 2025, ongoing as of August 2026) that weaponises the Google Visualization API as a command-and-control channel: obfuscated JavaScript payloads are stored in publicly published Google Sheets documents and retrieved via unauthenticated read-only queries, then injected into the victim's own browser session. The lure is a ClickFix variant — targets are socially engineered into pasting a `javascript:`\-prefixed loader into the Chrome navigation bar, or installing it into the Tampermonkey browser extension, under the pretence of exploiting a fictitious "API vulnerability" at cryptocurrency swap services (SwapZone\[.\]io, then SimpleSwap\[.\]io) for inflated trade payouts. The injected payload is a web skimmer that hooks the browser's `fetch` API, substitutes attacker-controlled Bitcoin deposit addresses in server responses and the clipboard, and displays counterfeit "bonus" UI elements; Talos identified 49 BTC wallets, with at least 0.159 BTC (\~$10,000) confirmed stolen from victims. Direct organisational exposure is low — the campaign targets individuals on crypto/development/hacking forums who are themselves willing to commit fraud — but the tradecraft (legitimate-service C2 inside trusted HTTPS to docs.google\[.\]com, user-executed browser injection, extension-based persistence) is directly transferable to supply-chain and e-commerce web-skimming attacks with far wider impact, and browser-resident C2 defeats the DNS/process-correlation hunting model most defenders use for Google-service abuse. No verified CVE, CVSS or CISA-KEV data is associated with this item; this is a social-engineering and legitimate-service-abuse campaign, not a vulnerability exploitation event.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The campaign is a criminal fraud operation against individuals, not an incident at a financial entity or an ICT third-party provider; no exploited vulnerability, no compromised provider, and no reportable incident at a client organisation is evidenced in the source material. Clients should treat this as threat-intelligence input to awareness and web-skimming readiness rather than a regulatory trigger.

## 3\. Technical analysis & attack chain

### Confirmed attack chain (all steps per Cisco Talos, single-sourced — see caveat below)

1. **Lure distribution.** Actors distribute links to a Google Docs document (filename "API Logic Flaw") via a Telegram channel (admin-post only, older posts deleted to disguise reposting of the same fake exploit), posts on dark web forums including DarkForums, comments on Pastebin and other text-sharing sites, and direct messages on crypto/software-development/cybersecurity/hacking forums. Waves sent at least twice monthly, coinciding with new Telegram postings. Early versions (from early October 2025) used email carrying links to a Google Docs "leaked security report."
2. **Social engineering.** The document is styled as a vulnerability report describing a nonexistent flaw — first a weakness in an older ChangeNOW exchange API allegedly still exposed through SwapZone\[.\]io yielding "\~38% higher payouts"; from April 18, 2026, a rewritten version targeting SimpleSwap\[.\]io claiming a "loyalty bonus" function flaw yielding a 25% trade-value boost. The mark is someone willing to commit fraud using technical means they don't understand.
3. **User-executed first stage.** Version 1 (April 12–16, 2026): target copies a script from a paste\[.\]sh link and pastes it into the Chrome navigation bar prefixed with `javascript:`, executing it in the context of the current web page. Version 2 (active from at least April 19, still active July 22 despite reports to Google): target installs the legitimate Tampermonkey extension from the Chrome Web Store and pastes a loader script (sourced from `hxxps://paste[.]sh/dQfdExjo#AqjB4BBt]lwLt2NKrlC0x8J9O`) into the extension's configuration; the script activates on every visit to SimpleSwap\[.\]io, providing persistence across sessions.
4. **Google Visualization API C2 retrieval.** Both loaders construct a Visualization API query against the same Google-hosted spreadsheet. The API (introduced 2008) provides free, unauthenticated read-only access to any publicly published Google Sheet via URI-embedded queries returning JSON or HTML tables, e.g.: `hxxps://docs[.]google[.]com/spreadsheets/d/[document identifier]/gviz/tq?tqx=out:json&tq=SELECT%20B` In version 1 the spreadsheet address is plainly visible in the sample and swapped for the fictitious vulnerable API's URL to build the query. In version 2 the Visualization API URL is hidden inside the fake SimpleSwap API address, Base64-encoded in the block after "bonus". The actors changed the queried cells and, after Talos disrupted operations in April, changed the target spreadsheet entirely.
5. **Payload reconstruction and injection.** The loaders concatenate the retrieved cell blocks into the full second-stage JavaScript and inject it into the browser session. Version 1 walks the page DOM looking for script elements associated with browser extensions; if more than one is found it picks a random one to inject into, otherwise a random `<script>` object on the page. Version 2 uses Tampermonkey to append the payload to the SimpleSwap page code on every load — simpler injection plus persistence.
6. **Web-skimmer execution.** The payload creates new UI elements and alters existing functions on the sites' cryptocurrency transaction interfaces. Per Talos's summary: it hooks the browser's `fetch` API, replaces cryptocurrency deposit addresses in server responses and in the user's clipboard, and displays counterfeit "bonus" interface elements. Result: victim funds are sent to attacker-controlled BTC wallets.
7. **Cash-out.** Talos identified 49 BTC wallet addresses; the majority of de-obfuscated samples (April–end June) used an identical set of 30, of which 24 received victim funds totalling 0.159 BTC (\~$10,000 at early-August 2026 valuations). Funds were routed through 30 further wallets, sometimes via multiple counterparties within the set, then moved in complex transactions involving over 3,000 additional addresses — likely a Bitcoin mixing operation. Actual take is likely higher: no samples prior to April were recovered and not all variants' wallets were captured.

**Payload obfuscation detail.** Talos collected 21 unique second-stage samples from the spreadsheet (including leftover SwapZone scripts after the pivot to SimpleSwap). To conceal spreadsheet contents from casual analysis, payload text was formatted white-on-white, with new rows added over time to push hidden cells further down the sheet — discoverable only via text search or API query. All but two samples used hex-pair arrays XOR-encoded, with math functions to render the code and garbage math concealing the XOR key; one sample used Base64 plus character-to-Unicode conversion (e.g. "A" → `\x41`); another paired XOR with Unicode-escaped apostrophes delimiting array elements. Each revision used a different XOR key and randomised variable/function names, consistent with output from Obfuscator\[.\]io and similar tools — but the underlying scripts were never functionally changed after initial coding per targeted site.

**Operational resilience of the actors.** After Talos reported the campaign to the targeted sites and Google in April, the lure and C2 documents were blocked; within a week the actors returned with a new Google Sheet and a new paste\[.\]sh script at a slightly reduced victim-recruitment rate. When paste\[.\]sh's administrator added automatic detection of first-stage script signatures in July, the actors moved all components into Google Docs and Google Sheets. As of August 11, the reported Google documents were still active.

**Why this matters beyond the fraud.** The C2 traffic originates from the Chrome browser and is indistinguishable from legitimate traffic to a trusted domain. Traditional hunting for Google-service C2 abuse relies on process/DNS correlation (e.g. a non-browser executable resolving docs.google\[.\]com); browser-resident C2 defeats this. Talos assesses the technique as a variation on classic web skimming (cf. Magecart, which relies on supply-chain compromise of third-party services, npm distributions and other web dependencies) and notes that actors with stolen access to web applications or browser-plugin update chains — citing supply-chain access sellers such as TeamPCP — could use these methods to selectively alter UI functionality with code delivered in what looks like legitimate application traffic.

**Confidence caveat.** Every technical claim, IOC and figure in this section is single-sourced to the Cisco Talos blog of 2026-09-08\. No second vendor, law-enforcement or exchange statement corroborates the campaign, the wallet set or the theft figures. Verify before enforcement action.

## 4\. Mitigation & containment

This is not a patchable vulnerability; containment is behavioural, procedural and monitoring-orientated.

### P1 — within 24 hours

- Block the known lure/C2 artefacts at web and egress layers where policy allows: the paste\[.\]sh first-stage URL (`hxxps://paste[.]sh/dQfdExjo#AqjB4BBt]lwLt2NKrlC0x8J9O`) and the "API Logic Flaw" Google Docs filename pattern. Note the actors rotate Google Sheets documents rapidly after takedowns — URL blocklists will decay; treat these as tripwires, not controls.
- Hunt retroactively for the behavioural signature: browser sessions to docs.google\[.\]com/spreadsheets containing `/gviz/tq` query strings (see §6), Tampermonkey (or other userscript manager) extensions installed on corporate endpoints, and `javascript:`\-prefixed paste events into Chrome's omnibox. Tampermonkey is legitimate software — its presence is not an incident, but an unexplained recent install on a trading or payments workstation warrants review of the installed userscripts.
- Review any corporate exposure to the named swap services (SwapZone\[.\]io, SimpleSwap\[.\]io) in treasury/crypto operations; if used, treat deposit-address verification as compromised at the browser layer and verify recipient addresses out-of-band before settlement.

### P2 — within 72 hours

- Deploy the ClamAV signature Talos published for this threat (referenced in the source; available via the Talos GitHub IOC repository linked in §7).
- Add detection logic for Visualization API abuse: alert on `/gviz/tq` URIs in proxied/SSL-inspected traffic, particularly with `tqx=out:json` and `SELECT` query fragments, originating from non-analyst users. This is the durable control — the API pattern survives the actors' infrastructure rotation.
- Brief fraud and payments teams: the clipboard- and fetch-hooking behaviour means any address copied from an affected browser session cannot be trusted. Reinforce callback/secondary-channel verification of crypto destination addresses for any client-side-initiated transfer.
- Update user awareness content to cover ClickFix variants that target the browser rather than the OS: warn specifically against pasting `javascript:` into the address bar and against installing userscripts from forums, Telegram channels or paste sites. The lure preys on willingness to commit fraud — standard "don't click links" messaging does not address it.

### P3 — within 7 days

- Assess e-commerce and customer-facing web properties for the supply-chain variant Talos warns of: inventory third-party scripts, npm dependencies and browser-extension update paths; confirm Subresource Integrity (SRI) and CSP script-src restrictions are enforced so that injected/modified scripts fail to execute.
- Extend threat hunting to the general class: any browser-originated DNS/HTTPS to Google Docs/Sheets/Drive from users with no business need, and any userscript-manager extension on managed estates. Consider blocklisting userscript managers on regulated desktop builds unless a business case exists.
- For crypto-adjacent clients: monitor the 49 BTC addresses in §5 against on-chain flows touching corporate or customer wallets.

## 5\. Indicators of compromise

All indicators are single-sourced to the Cisco Talos blog. Talos states a fuller IOC set is published in their GitHub repository (linked in §7); only indicators present in the provided source material are listed here.

| type        | value                                                                                       | confidence                                                                             | source                  |
| ----------- | ------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | ----------------------- |
| domain      | paste\[.\]sh                                                                                | high — first-stage hosting, per Talos                                                  | Cisco Talos, 2026-09-08 |
| url         | hxxps://paste\[.\]sh/dQfdExjo#AqjB4BBt\]lwLt2NKrlC0x8J9O                                    | high — second-lure loader script location                                              | Cisco Talos, 2026-09-08 |
| domain      | docs.google\[.\]com                                                                         | high — lure documents and Visualization API C2                                         | Cisco Talos, 2026-09-08 |
| uri-path    | /spreadsheets/d/\*/gviz/tq                                                                  | high — Visualization API C2 query pattern                                              | Cisco Talos, 2026-09-08 |
| filename    | "API Logic Flaw" (Google Docs lure document name)                                           | high — both lure variants                                                              | Cisco Talos, 2026-09-08 |
| domain      | SwapZone\[.\]io                                                                             | high — targeted site (v1 lure)                                                         | Cisco Talos, 2026-09-08 |
| domain      | SimpleSwap\[.\]io                                                                           | high — targeted site (v2 lure)                                                         | Cisco Talos, 2026-09-08 |
| btc-address | 49 wallet addresses used by the campaign (30-address primary set; 24 received victim funds) | medium — full list held in Talos GitHub IOC repo, not enumerated in the source article | Cisco Talos, 2026-09-08 |

Note: the specific Google Sheets document identifiers and the 49 BTC addresses are not enumerated in the provided source text; retrieve them from the Talos GitHub repository before enforcement. The actors rotate spreadsheets after disruption, so document-level indicators have short shelf life.

```iocs
domain  paste[.]sh
url  hxxps://paste[.]sh/dQfdExjo#AqjB4BBt]lwLt2NKrlC0x8J9O
domain  docs.google[.]com
uri-path  /spreadsheets/d/*/gviz/tq
domain  SwapZone[.]io
domain  SimpleSwap[.]io

```

### Behavioural indicators

| behaviour                                                                                                                                                                                        | where to observe                                                                                      | confidence |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------- | ---------- |
| Visualization API queries (/gviz/tq, tqx=out:json, SQL-like SELECT fragments) in proxied/inspected HTTPS to docs.google\[.\]com                                                                  | Web proxy / SSL inspection logs, DNS + HTTP logs                                                      | high       |
| Tampermonkey (or other userscript manager) extension newly installed on managed endpoints                                                                                                        | Endpoint browser-extension inventory, Chrome enterprise policy reporting                              | high       |
| User pasting javascript:\-prefixed strings into the Chrome omnibox (Chrome drops such paste execution by default; attempts may still appear in EDR clipboard/keystroke telemetry where deployed) | EDR, DLP clipboard monitoring                                                                         | medium     |
| fetch API hooking and clipboard modification within a browser session on crypto trading pages                                                                                                    | Browser telemetry / EDR where script-hooking detection exists; difficult without host instrumentation | medium     |
| Inbound or outbound BTC flows involving the campaign's 30-wallet primary set                                                                                                                     | Blockchain analytics (Chainalysis/TRM/Equivalent), transaction monitoring                             | medium     |

## 6\. Detection

The sources provide usable artefacts: the Visualization API query pattern, the lure document filename, the paste\[.\]sh loader URL, and the targeted domains. No file hashes, mutexes or registry keys are present in the source material.

```yara
rule TALOS_ClickFix_GoogleVizC2_Loader_JS
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-08"
        reference = "https://blog.talosintelligence.com/clickfix-moves-into-the-browser/"
        description = "Detects ClickFix browser-injection loader scripts using Google Visualization API C2, per Cisco Talos AT-2026-09 reporting"
    strings:
        $gviz1 = "/gviz/tq" ascii
        $gviz2 = "tqx=out:json" ascii
        $gviz3 = "docs.google" ascii
        $paste = "paste.sh/dQfdExjo" ascii
        $jscheme = "javascript:" ascii
        $b64hint = "bonus" ascii
    condition:
        uint16(0) == 0x5F3C or filesize < 200KB
        and 2 of ($gviz*)
        and 1 of ($paste, $jscheme, $b64hint)
}

```

Caveat: the loader scripts are heavily obfuscated (XOR-encoded hex arrays, Base64, Unicode escaping, randomised identifiers per revision), so string-based YARA will catch only unobfuscated segments such as the Visualization API URI construction and the Base64-wrapped URL container. The `/gviz/tq` and `docs.google` fragments are the most durable strings; the paste\[.\]sh reference applies only to the second-lure loader. Talos also published a ClamAV signature for this threat — deploy that in preference to, or alongside, this rule.

```yaml
title: Suspicious Google Visualization API query from browser session
id: 8f3c2a91-7d44-4e6b-9a15-2c8e5f0b7881
status: experimental
description: >
  Detects HTTP(S) requests to docs.google.com containing the Google Visualization
  API endpoint /gviz/tq, used as C2 by the ClickFix browser-injection campaign
  reported by Cisco Talos (2026-09-08). Legitimate use exists (published-sheet
  dashboards), so tune by user population.
references:

  - https://blog.talosintelligence.com/clickfix-moves-into-the-browser/
author: Adverse Trace
date: 2026-09-08
logsource:
    category: proxy
detection:
    selection_host:
        cs-host|contains: 'docs.google.com'
    selection_uri:
        cs-uri-query|contains: '/gviz/tq'
    selection_out:
        cs-uri-query|contains: 'out:json'
    condition: selection_host and selection_uri
falsepositives:

    - Legitimate dashboards or applications embedding published Google Sheets data
level: medium

```

## 7\. Sources

- Cisco Talos, "ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2," https://blog.talosintelligence.com/clickfix-moves-into-the-browser/, 2026-09-08
- Cisco Talos IOC repository for this campaign (referenced in the source article as "available at our GitHub repository"), https://blog.talosintelligence.com/clickfix-moves-into-the-browser/ (follow-through link)

## 8\. Adverse Trace position

This is a low-direct-impact, high-technique-significance item. Severity for EMEA financial services clients is assessed as **low for direct exposure** — the victims are individuals on crypto and hacking forums attempting their own fraud, and no client-side vulnerability, CVE or organisational compromise is involved — but the tradecraft is **materially significant**: unauthenticated Google Visualization API C2 tunneled inside trusted HTTPS to docs.google\[.\]com, user-executed browser injection, and extension-based persistence collectively defeat network telemetry and represent a credible template for Magecart-style web skimming against e-commerce and customer-facing financial platforms, particularly if combined with the supply-chain access Talos notes is being sold. Attribution is unconfirmed: no named actor is identified in the source and no MITRE profile exists in the verified reference data; treat all campaign detail as single-sourced to Cisco Talos and verify before enforcement. We will monitor for (a) independent corroboration or a second vendor's reporting, (b) any pivot of this Visualization API C2 pattern toward e-commerce or banking web properties, and (c) Google-side enforcement against the still-active documents; clients with crypto treasury functions should ingest the Talos wallet IOC set into transaction monitoring immediately.

---

[Read the original source →](https://blog.talosintelligence.com/clickfix-moves-into-the-browser/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*