ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

1. Executive summary

Cisco Talos documents a monthslong criminal campaign (active since early October 2025, ongoing as of August 2026) that weaponises the Google Visualization API as a command-and-control channel: obfuscated JavaScript payloads are stored in publicly published Google Sheets documents and retrieved via unauthenticated read-only queries, then injected into the victim's own browser session. The lure is a ClickFix variant — targets are socially engineered into pasting a javascript:-prefixed loader into the Chrome navigation bar, or installing it into the Tampermonkey browser extension, under the pretence of exploiting a fictitious "API vulnerability" at cryptocurrency swap services (SwapZone[.]io, then SimpleSwap[.]io) for inflated trade payouts. The injected payload is a web skimmer that hooks the browser's fetch API, substitutes attacker-controlled Bitcoin deposit addresses in server responses and the clipboard, and displays counterfeit "bonus" UI elements; Talos identified 49 BTC wallets, with at least 0.159 BTC (~$10,000) confirmed stolen from victims. Direct organisational exposure is low — the campaign targets individuals on crypto/development/hacking forums who are themselves willing to commit fraud — but the tradecraft (legitimate-service C2 inside trusted HTTPS to docs.google[.]com, user-executed browser injection, extension-based persistence) is directly transferable to supply-chain and e-commerce web-skimming attacks with far wider impact, and browser-resident C2 defeats the DNS/process-correlation hunting model most defenders use for Google-service abuse. No verified CVE, CVSS or CISA-KEV data is associated with this item; this is a social-engineering and legitimate-service-abuse campaign, not a vulnerability exploitation event.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The campaign is a criminal fraud operation against individuals, not an incident at a financial entity or an ICT third-party provider; no exploited vulnerability, no compromised provider, and no reportable incident at a client organisation is evidenced in the source material. Clients should treat this as threat-intelligence input to awareness and web-skimming readiness rather than a regulatory trigger.

3. Technical analysis & attack chain

Confirmed attack chain (all steps per Cisco Talos, single-sourced — see caveat below)

1. Lure distribution. Actors distribute links to a Google Docs document (filename "API Logic Flaw") via a Telegram channel (admin-post only, older posts deleted to disguise reposting of the same fake exploit), posts on dark web forums including DarkForums, comments on Pastebin and other text-sharing sites, and direct messages on crypto/software-development/cybersecurity/hacking forums. Waves sent at least twice monthly, coinciding with new Telegram postings. Early versions (from early October 2025) used email carrying links to a Google Docs "leaked security report."
2. Social engineering. The document is styled as a vulnerability report describing a nonexistent flaw — first a weakness in an older ChangeNOW exchange API allegedly still exposed through SwapZone[.]io yielding "~38% higher payouts"; from April 18, 2026, a rewritten version targeting SimpleSwap[.]io claiming a "loyalty bonus" function flaw yielding a 25% trade-value boost. The mark is someone willing to commit fraud using technical means they don't understand.
3. User-executed first stage. Version 1 (April 12–16, 2026): target copies a script from a paste[.]sh link and pastes it into the Chrome navigation bar prefixed with javascript:, executing it in the context of the current web page. Version 2 (active from at least April 19, still active July 22 despite reports to Google): target installs the legitimate Tampermonkey extension from the Chrome Web Store and pastes a loader script (sourced from hxxps://paste[.]sh/dQfdExjo#AqjB4BBt]lwLt2NKrlC0x8J9O) into the extension's configuration; the script activates on every visit to SimpleSwap[.]io, providing persistence across sessions.
4. Google Visualization API C2 retrieval. Both loaders construct a Visualization API query against the same Google-hosted spreadsheet. The API (introduced 2008) provides free, unauthenticated read-only access to any publicly published Google Sheet via URI-embedded queries returning JSON or HTML tables, e.g.: hxxps://docs[.]google[.]com/spreadsheets/d/[document identifier]/gviz/tq?tqx=out:json&tq=SELECT%20B In version 1 the spreadsheet address is plainly visible in the sample and swapped for the fictitious vulnerable API's URL to build the query. In version 2 the Visualization API URL is hidden inside the fake SimpleSwap API address, Base64-encoded in the block after "bonus". The actors changed the queried cells and, after Talos disrupted operations in April, changed the target spreadsheet entirely.
5. Payload reconstruction and injection. The loaders concatenate the retrieved cell blocks into the full second-stage JavaScript and inject it into the browser session. Version 1 walks the page DOM looking for script elements associated with browser extensions; if more than one is found it picks a random one to inject into, otherwise a random <script> object on the page. Version 2 uses Tampermonkey to append the payload to the SimpleSwap page code on every load — simpler injection plus persistence.
6. Web-skimmer execution. The payload creates new UI elements and alters existing functions on the sites' cryptocurrency transaction interfaces. Per Talos's summary: it hooks the browser's fetch API, replaces cryptocurrency deposit addresses in server responses and in the user's clipboard, and displays counterfeit "bonus" interface elements. Result: victim funds are sent to attacker-controlled BTC wallets.
7. Cash-out. Talos identified 49 BTC wallet addresses; the majority of de-obfuscated samples (April–end June) used an identical set of 30, of which 24 received victim funds totalling 0.159 BTC (~$10,000 at early-August 2026 valuations). Funds were routed through 30 further wallets, sometimes via multiple counterparties within the set, then moved in complex transactions involving over 3,000 additional addresses — likely a Bitcoin mixing operation. Actual take is likely higher: no samples prior to April were recovered and not all variants' wallets were captured.

Payload obfuscation detail. Talos collected 21 unique second-stage samples from the spreadsheet (including leftover SwapZone scripts after the pivot to SimpleSwap). To conceal spreadsheet contents from casual analysis, payload text was formatted white-on-white, with new rows added over time to push hidden cells further down the sheet — discoverable only via text search or API query. All but two samples used hex-pair arrays XOR-encoded, with math functions to render the code and garbage math concealing the XOR key; one sample used Base64 plus character-to-Unicode conversion (e.g. "A" → \x41); another paired XOR with Unicode-escaped apostrophes delimiting array elements. Each revision used a different XOR key and randomised variable/function names, consistent with output from Obfuscator[.]io and similar tools — but the underlying scripts were never functionally changed after initial coding per targeted site.

Operational resilience of the actors. After Talos reported the campaign to the targeted sites and Google in April, the lure and C2 documents were blocked; within a week the actors returned with a new Google Sheet and a new paste[.]sh script at a slightly reduced victim-recruitment rate. When paste[.]sh's administrator added automatic detection of first-stage script signatures in July, the actors moved all components into Google Docs and Google Sheets. As of August 11, the reported Google documents were still active.

Why this matters beyond the fraud. The C2 traffic originates from the Chrome browser and is indistinguishable from legitimate traffic to a trusted domain. Traditional hunting for Google-service C2 abuse relies on process/DNS correlation (e.g. a non-browser executable resolving docs.google[.]com); browser-resident C2 defeats this. Talos assesses the technique as a variation on classic web skimming (cf. Magecart, which relies on supply-chain compromise of third-party services, npm distributions and other web dependencies) and notes that actors with stolen access to web applications or browser-plugin update chains — citing supply-chain access sellers such as TeamPCP — could use these methods to selectively alter UI functionality with code delivered in what looks like legitimate application traffic.

Confidence caveat. Every technical claim, IOC and figure in this section is single-sourced to the Cisco Talos blog of 2026-09-08. No second vendor, law-enforcement or exchange statement corroborates the campaign, the wallet set or the theft figures. Verify before enforcement action.

4. Mitigation & containment

This is not a patchable vulnerability; containment is behavioural, procedural and monitoring-orientated.

P1 — within 24 hours

• Block the known lure/C2 artefacts at web and egress layers where policy allows: the paste[.]sh first-stage URL (hxxps://paste[.]sh/dQfdExjo#AqjB4BBt]lwLt2NKrlC0x8J9O) and the "API Logic Flaw" Google Docs filename pattern. Note the actors rotate Google Sheets documents rapidly after takedowns — URL blocklists will decay; treat these as tripwires, not controls.
• Hunt retroactively for the behavioural signature: browser sessions to docs.google[.]com/spreadsheets containing /gviz/tq query strings (see §6), Tampermonkey (or other userscript manager) extensions installed on corporate endpoints, and javascript:-prefixed paste events into Chrome's omnibox. Tampermonkey is legitimate software — its presence is not an incident, but an unexplained recent install on a trading or payments workstation warrants review of the installed userscripts.
• Review any corporate exposure to the named swap services (SwapZone[.]io, SimpleSwap[.]io) in treasury/crypto operations; if used, treat deposit-address verification as compromised at the browser layer and verify recipient addresses out-of-band before settlement.

P2 — within 72 hours

• Deploy the ClamAV signature Talos published for this threat (referenced in the source; available via the Talos GitHub IOC repository linked in §7).
• Add detection logic for Visualization API abuse: alert on /gviz/tq URIs in proxied/SSL-inspected traffic, particularly with tqx=out:json and SELECT query fragments, originating from non-analyst users. This is the durable control — the API pattern survives the actors' infrastructure rotation.
• Brief fraud and payments teams: the clipboard- and fetch-hooking behaviour means any address copied from an affected browser session cannot be trusted. Reinforce callback/secondary-channel verification of crypto destination addresses for any client-side-initiated transfer.
• Update user awareness content to cover ClickFix variants that target the browser rather than the OS: warn specifically against pasting javascript: into the address bar and against installing userscripts from forums, Telegram channels or paste sites. The lure preys on willingness to commit fraud — standard "don't click links" messaging does not address it.

P3 — within 7 days

• Assess e-commerce and customer-facing web properties for the supply-chain variant Talos warns of: inventory third-party scripts, npm dependencies and browser-extension update paths; confirm Subresource Integrity (SRI) and CSP script-src restrictions are enforced so that injected/modified scripts fail to execute.
• Extend threat hunting to the general class: any browser-originated DNS/HTTPS to Google Docs/Sheets/Drive from users with no business need, and any userscript-manager extension on managed estates. Consider blocklisting userscript managers on regulated desktop builds unless a business case exists.
• For crypto-adjacent clients: monitor the 49 BTC addresses in §5 against on-chain flows touching corporate or customer wallets.

5. Indicators of compromise

All indicators are single-sourced to the Cisco Talos blog. Talos states a fuller IOC set is published in their GitHub repository (linked in §7); only indicators present in the provided source material are listed here.

Note: the specific Google Sheets document identifiers and the 49 BTC addresses are not enumerated in the provided source text; retrieve them from the Talos GitHub repository before enforcement. The actors rotate spreadsheets after disruption, so document-level indicators have short shelf life.

domain  paste[.]sh
url  hxxps://paste[.]sh/dQfdExjo#AqjB4BBt]lwLt2NKrlC0x8J9O
domain  docs.google[.]com
uri-path  /spreadsheets/d/*/gviz/tq
domain  SwapZone[.]io
domain  SimpleSwap[.]io

Behavioural indicators

6. Detection

The sources provide usable artefacts: the Visualization API query pattern, the lure document filename, the paste[.]sh loader URL, and the targeted domains. No file hashes, mutexes or registry keys are present in the source material.

rule TALOS_ClickFix_GoogleVizC2_Loader_JS
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-08"
        reference = "https://blog.talosintelligence.com/clickfix-moves-into-the-browser/"
        description = "Detects ClickFix browser-injection loader scripts using Google Visualization API C2, per Cisco Talos AT-2026-09 reporting"
    strings:
        $gviz1 = "/gviz/tq" ascii
        $gviz2 = "tqx=out:json" ascii
        $gviz3 = "docs.google" ascii
        $paste = "paste.sh/dQfdExjo" ascii
        $jscheme = "javascript:" ascii
        $b64hint = "bonus" ascii
    condition:
        uint16(0) == 0x5F3C or filesize < 200KB
        and 2 of ($gviz*)
        and 1 of ($paste, $jscheme, $b64hint)
}

Caveat: the loader scripts are heavily obfuscated (XOR-encoded hex arrays, Base64, Unicode escaping, randomised identifiers per revision), so string-based YARA will catch only unobfuscated segments such as the Visualization API URI construction and the Base64-wrapped URL container. The /gviz/tq and docs.google fragments are the most durable strings; the paste[.]sh reference applies only to the second-lure loader. Talos also published a ClamAV signature for this threat — deploy that in preference to, or alongside, this rule.

title: Suspicious Google Visualization API query from browser session
id: 8f3c2a91-7d44-4e6b-9a15-2c8e5f0b7881
status: experimental
description: >
  Detects HTTP(S) requests to docs.google.com containing the Google Visualization
  API endpoint /gviz/tq, used as C2 by the ClickFix browser-injection campaign
  reported by Cisco Talos (2026-09-08). Legitimate use exists (published-sheet
  dashboards), so tune by user population.
references:

  - https://blog.talosintelligence.com/clickfix-moves-into-the-browser/
author: Adverse Trace
date: 2026-09-08
logsource:
    category: proxy
detection:
    selection_host:
        cs-host|contains: 'docs.google.com'
    selection_uri:
        cs-uri-query|contains: '/gviz/tq'
    selection_out:
        cs-uri-query|contains: 'out:json'
    condition: selection_host and selection_uri
falsepositives:

    - Legitimate dashboards or applications embedding published Google Sheets data
level: medium

7. Sources

• Cisco Talos, "ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2," https://blog.talosintelligence.com/clickfix-moves-into-the-browser/, 2026-09-08
• Cisco Talos IOC repository for this campaign (referenced in the source article as "available at our GitHub repository"), https://blog.talosintelligence.com/clickfix-moves-into-the-browser/ (follow-through link)

8. Adverse Trace position

This is a low-direct-impact, high-technique-significance item. Severity for EMEA financial services clients is assessed as low for direct exposure — the victims are individuals on crypto and hacking forums attempting their own fraud, and no client-side vulnerability, CVE or organisational compromise is involved — but the tradecraft is materially significant: unauthenticated Google Visualization API C2 tunneled inside trusted HTTPS to docs.google[.]com, user-executed browser injection, and extension-based persistence collectively defeat network telemetry and represent a credible template for Magecart-style web skimming against e-commerce and customer-facing financial platforms, particularly if combined with the supply-chain access Talos notes is being sold. Attribution is unconfirmed: no named actor is identified in the source and no MITRE profile exists in the verified reference data; treat all campaign detail as single-sourced to Cisco Talos and verify before enforcement. We will monitor for (a) independent corroboration or a second vendor's reporting, (b) any pivot of this Visualization API C2 pattern toward e-commerce or banking web properties, and (c) Google-side enforcement against the still-active documents; clients with crypto treasury functions should ingest the Talos wallet IOC set into transaction monitoring immediately.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.