5 minmedium
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
A ClickFix social engineering campaign abuses Google Sheets as C2 to inject web-skimming JavaScript into browsers, replacing crypto deposit addresses with attacker wallets. Attackers distribute fake vulnerability reports via Telegram and forums, tricking users into pasting malicious JavaScript into Chrome or Tampermonkey. The script fetches obfuscated payloads from Google Sheets via the Visualization API, then hooks the browser fetch API to replace crypto deposit addresses and hijack clipboards.
Sens:▲ 24hConf:high
IOCs7
7url
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block the identified Google Sheets and Google Docs URLs used as C2 and lure pages
- Monitor for and remove Tampermonkey scripts targeting cryptocurrency sites
- Block the Telegram channel distributing the lures
Key Takeaways
- Campaign active since October 2025, targeting crypto traders via fake API exploit lures.
- Google Visualization API used for unauthenticated, read-only C2 via published Google Sheets.
- Tampermonkey extension abused for persistence across browser sessions.
- 49 BTC wallets identified; 24 received victim funds totaling 0.159 BTC (~$10,000).
- Scripts use XOR obfuscation and fetch API hijacking to replace crypto addresses and clipboard data.
Attack Chain
- Initial Access: Lure distributed via Telegram and forums linking to fake exploit docs on Google Docs
- Execution: User pastes JavaScript into Chrome address bar or Tampermonkey extension
- C2: Script queries Google Sheets via Visualization API to retrieve obfuscated stage 2 payload
- Persistence: Tampermonkey extension reloads malicious script on each visit to targeted site
- Collection/Exfiltration: Stage 2 hooks fetch API, replaces crypto deposit addresses and clipboard data with attacker wallets
Affected Systems
- Google Chrome web browser
- Tampermonkey browser extension
- SwapZone.io cryptocurrency exchange
- SimpleSwap.io cryptocurrency exchange
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Malicious activity occurs within browser process context and legitimate Google services, making EDR telemetry less useful. |
| Network Visibility | Low | C2 traffic blends with legitimate HTTPS requests to docs.google.com from the browser. |
| Detection Difficulty | Hard | Abuse of legitimate Google services and browser-based execution makes network and endpoint detection extremely difficult. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for browser processes making Visualization API requests to Google Sheets without corresponding user-initiated Google Docs activity (T1105). | DNS logs, HTTP proxy logs, browser telemetry | Command and Control | Medium — legitimate developers may query published sheets |
| Hunt for Tampermonkey or similar browser extensions injecting scripts into financial or cryptocurrency websites (T1059.007). | Browser extension logs, EDR browser telemetry | Execution | Low — script injection into financial sites is unusual |
| Hunt for JavaScript overriding fetch API and modifying clipboard events in browser sessions (T1056.004). | Browser debug logs, EDR browser telemetry | Collection | Low — fetch API hooking is rare in normal browsing |
Required Log Sources
- Browser extension inventory logs
- DNS query logs
- HTTP proxy logs with URL filtering
- Web application firewall logs for targeted crypto sites
Key Behavioral Indicators
- Tampermonkey scripts targeting cryptocurrency exchange domains
- JavaScript fetch API hooks modifying JSON responses with deposit addresses
- Clipboard write events replacing copied cryptocurrency addresses
- Google Visualization API queries from browser sessions without other Google Docs activity
- MutationObserver usage in injected scripts for DOM manipulation
- Base64-encoded Google Sheets URLs embedded in JavaScript variables
Control Gaps
- Network DLP cannot inspect HTTPS payload content within Google traffic
- Endpoint AV does not scan browser extension scripts or in-memory JS
- URL filtering may allow docs.google.com by default
- Browser extension management may be unmanaged in many organizations
False Positive Assessment
Medium — Google Visualization API and Tampermonkey have legitimate uses, but queries to specific sheet IDs and script injection into crypto sites are suspicious.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict access to docs.google.com for users who do not require Google Docs for business use
- Deploy SSL inspection for Google services to detect Visualization API C2 patterns
- Block paste.sh if not required for business operations
User Protection
- Manage browser extensions centrally; restrict Tampermonkey installation by role
- Disable JavaScript execution from the Chrome address bar via enterprise policy
- Deploy browser security extensions that detect DOM manipulation and fetch API hooking
Security Awareness
- Warn users about ClickFix social engineering and pasting code into browsers
- Train users to recognize fake vulnerability reports and exploit lures
- Advise users never to install browser extensions from untrusted sources
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Plain-Language Summary
Criminals are tricking cryptocurrency traders into installing malicious code in their web browsers by promising fake exploit tools. The code steals cryptocurrency by swapping the recipient address during trades. Users should avoid pasting code from untrusted sources into their browsers or browser extensions.
Additional IOCs
- Command Lines:
- Purpose: Execute malicious JavaScript directly in browser context | Tools:
Chrome address bar| Stage: Execution |javascript:async function updateNodeProtocol() { ...
- Purpose: Execute malicious JavaScript directly in browser context | Tools:
- Other:
1F9SXBFw02K8KVxQDhOZ2FfMFWSk05klvi_QpgU7Sa6o- Google Sheets document ID used as C2 payload repository1ai6llKkMFCKKgDMj8kWdFCeKhKetv- Secondary Google Sheets document ID used as C2
Showing defanged values
- urlhxxps://docs[.]google[.]com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharingGoogle Docs lure document distributed via forum DMs
- urlhxxps://docs[.]google[.]com/document/d/1ifNm-s74mX7GChaEzSJ1dVQCy1SrSxlMVRYi8ys0rgQ/edit?usp=sharingGoogle Docs lure document for SimpleSwap fake exploit
- urlhxxps://docs[.]google[.]com/document/d/1S1iTruSLkgEP08QtTuo2twS4f2FoJ3_l0-p4GKqeAUY/edit?usp=sharingGoogle Docs lure document shared by forum user ZORNIITOZ
- urlhxxps://docs[.]google[.]com/spreadsheets/d/1F9SXBFw02K8KVxQDhOZ2FfMFWSk05klvi_QpgU7Sa6o/gviz/tq?sheet=API&headers=1&tq=select%20A%2CB%20where%20A='api_1'%20or%20A='api_2'Google Visualization API C2 URL retrieving stage 2 payload
- urlhxxps://paste[.]sh/dQfdExjo#AqjB4BBt]lwLt2NKrlC0x8J9OStage 1 loader script for Tampermonkey variant
- urlhxxps://paste[.]sh/ZJTbsTYA#o_27QHnzqW-CGwoKJNVYcSt9Stage 1 loader script for Chrome address bar variant
- urlhxxps://t[.]me/theprotocoloneTelegram channel distributing ClickFix lures