“Talos said the campaign posed no specific threat to most organizations but that the techniques did.” That assessment, buried in technical detail, frames the risk: an established fraud operation moved from coaxing victims to run commands on their machines to convincing them to inject malicious code directly into their browsers — and it found ways to make those requests look routine.
ClickFix's shift from OS commands to browser scripts
Cisco Talos documented a months-long campaign it calls ClickFix that began in October 2025 with lures instructing targets to paste JavaScript into Chrome's navigation bar. Starting in March 2026 attackers layered in the Google Visualization API, and from mid‑April they told victims to install the Tampermonkey browser extension before adding a script. The lures were cast widely: Talos found material on Telegram, the cybercrime forum DarkForums and on text‑sharing sites, with waves of messages appearing at least twice a month.
Google Visualization API and Google Sheets used as a payload delivery channel
Talos explains the attackers abused the Google Visualization API to deliver obfuscated, second‑stage code from public Google Sheets documents. Because the API provides free, unauthenticated read‑only access to any Sheets document published to the web, requests for the payload came from victims' own browsers and resembled ordinary web traffic. The operators hid payload cells by making text white on white. Talos alerted Google and the targeted sites in April; the campaign returned a week later using a new spreadsheet, and as of August 11 the replacement Google documents had been reported again but remained live.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageInjected scripts: replacing addresses, hijacking fetch, and clipboard skimming
Talos collected 21 second‑stage payloads from the spreadsheet. The samples rotated XOR keys and randomized variable names, but were functionally unchanged. Once installed, the scripts monitored page changes on two cryptocurrency trading sites, replacing displayed deposit addresses and altering transaction amounts so the interface appeared to show a bonus. The code overrode the browser's fetch API, substituting attacker wallet addresses into deposit responses before that data reached the page. A clipboard function replaced any address a victim copied. On the Tampermonkey variant, Talos found the malicious script reloaded on every visit to the targeted site.
Financial trail: 49 Bitcoin addresses, 0.159 BTC received, and apparent mixing
Talos identified 49 Bitcoin addresses connected to the campaign. Most decoded samples from April through late June relied on one set of 30 addresses; of those, 24 received victim funds totaling 0.159 BTC — about $10,000 at early August valuations. Talos cautioned the true proceeds were probably higher, noting that funds were routed through 30 additional wallets and then into more than 3,000 addresses in what the researchers described as a mixing operation.
What Cisco Talos recommends for security teams and what crypto traders should watch
- For technologists and security teams: Talos advised restricting browser extensions by role and monitoring browser sessions for requests to Google Docs. The campaign demonstrates a delivery channel that looks like normal web traffic because payload requests originate from victims' browsers.
- For end users and crypto traders: the lures posed as leaked vulnerability reports promising payouts up to 38% higher on non‑existent API flaws at cryptocurrency swap services — an appeal aimed at people willing to exploit a flaw they did not understand. Talos's findings underline the risks of following instructions to paste code into a browser, installing third‑party userscripts such as Tampermonkey, or trusting text‑shared "leaks" on forums and messaging apps.
- For Google and the targeted sites: Talos notified Google and the affected trading sites in April; the operation proved resilient, returning quickly on a new spreadsheet. The persistence of live replacement documents as of August 11 highlights a gap between notification and full takedown of malicious distribution channels that use legitimate public hosting.
The ClickFix campaign is notable less for a single, large payout than for its adaptability: it shifted the threat surface from operating‑system commands to the browser, weaponized a legitimate Google API and used social engineering that specifically targeted people ready to commit fraud. Talos's technical mapping — the 21 payloads, the 49 addresses, the 0.159 BTC confirmed receipts and the onward mixing through thousands of addresses — gives investigators a clear forensic trail. Whether platform controls, extension‑management policies and site defenses will be adjusted quickly enough to blunt this delivery pattern remains an open question.
https://www.infosecurity-magazine.com/news/clickfix-browser-cryptocurrency/
