ClickFix Campaign Abuses Google Visualization API for Cryptocurrency Theft
Attackers are leveraging the Google Visualization API to serve malicious JavaScript for cryptocurrency theft, tricking users into injecting code into their browsers.
A sophisticated cryptocurrency theft campaign is actively abusing Google's Visualization API to serve malicious JavaScript, enabling attackers to steal funds directly from unsuspecting users. Cisco Talos Intelligence reports that the campaign, a variation of the "ClickFix" social engineering tactic, lures victims into pasting obfuscated JavaScript code into their browser's address bar or injecting it via the Tampermonkey browser extension. This injected script then acts as a web skimmer, altering cryptocurrency deposit addresses and displaying fake bonus elements to trick users into sending funds to attacker-controlled wallets.
The campaign's evolution showcases a shift in tactics, moving from initial attempts to have users execute commands on their operating systems to manipulating their browser sessions. Early versions, observed starting in October 2025, focused on direct execution in the Chrome address bar. By March 2026, the threat actors began utilizing the Google Visualization API to retrieve malicious scripts stored within publicly accessible Google Sheets documents. This move to cloud-based storage, particularly Google Docs and Sheets, was further solidified by July 2026 after disruptions to their previous distribution methods on paste sites.
The social engineering lures are crafted to appeal to individuals interested in cryptocurrency trading, software development, and cybersecurity forums. They pose as reports detailing non-existent API vulnerabilities in cryptocurrency swap services, promising financial gain to those who exploit them. This specific targeting suggests the attackers are looking for users who are technically inclined but may not fully grasp the implications of executing unknown code, making them susceptible to fraud.
The core of the attack relies on the Google Visualization API, a feature that allows unauthenticated, read-only access to publicly published Google Sheets data. Attackers embed obfuscated JavaScript within specific cells of a Google Sheet. A specially crafted URI query then retrieves this JavaScript, which is subsequently injected into the victim's browser session. This technique cleverly disguises malicious C2 communications within traffic to a trusted Google domain, making detection significantly more challenging than traditional malware.
Once injected, the malicious script hooks the browser's fetch API to intercept and modify network responses. It specifically targets cryptocurrency deposit addresses displayed on trading websites and even those copied to the user's clipboard. By replacing these legitimate addresses with their own, the attackers ensure that any funds sent by the victim are rerouted directly to their wallets. The addition of counterfeit "bonus" or "reward" elements further enhances the deception, encouraging users to complete transactions.
While this particular campaign primarily targets individual cryptocurrency traders, the techniques employed are noteworthy and could be adapted for broader attacks. The abuse of legitimate cloud services like Google Sheets for C2 infrastructure and the manipulation of browser sessions represent a growing trend in cybercriminal operations. Such methods can be leveraged in more impactful attacks, including supply-chain compromises targeting e-commerce platforms and other customer-facing systems.
Detecting such threats requires a shift in monitoring strategies. Traditional network-based detection often focuses on suspicious DNS requests or process behavior. However, when malicious activity originates from within a browser session, especially one communicating with trusted domains like Google, detection becomes considerably more difficult. Security teams must increasingly rely on endpoint visibility and browser-level telemetry to identify these sophisticated attacks.
The actors behind this campaign have demonstrated adaptability, altering their distribution methods and C2 infrastructure when disrupted. This ongoing evolution underscores the need for continuous vigilance and the development of more robust detection mechanisms capable of identifying subtle manipulations within trusted application ecosystems.