Imagine preparing a cryptocurrency deposit after discovering a supposed secret trading advantage. The offer looks technical, convincing, and incredibly profitable. Then, without warning, the wallet address shown by your browser changes. You copy the address carefully and complete the transaction. However, your cryptocurrency never reaches the intended destination. Instead, the funds travel directly to an attacker-controlled wallet.
That scenario describes a new cryptocurrency theft campaign investigated by Cisco Talos. The attackers combine ClickFix-style social engineering with browser-based JavaScript injection. They also abuse Google Sheets as a hidden command-and-control channel.
The campaign demonstrates an important security lesson. A familiar website or trusted cloud service does not automatically make every browser request safe.
How the ClickFix Cryptocurrency Attack Works
ClickFix attacks typically manipulate users into executing commands themselves. Instead of exploiting a technical vulnerability, criminals exploit human trust and curiosity. This campaign takes that strategy into the browser. Victims receive instructions that appear to reveal a profitable cryptocurrency opportunity. The fake report claims that a trading platform contains an undisclosed API weakness. Users are promised unusually high returns or special bonuses.
However, the supposed vulnerability does not exist. The real objective involves getting the victim to execute malicious JavaScript. Early versions instructed users to paste JavaScript into Chrome’s address bar. Later versions used the Tampermonkey browser extension. Once executed, the loader contacts a publicly available Google Sheet. The sheet contains hidden and obfuscated JavaScript code.
The browser retrieves that code through Google’s Visualization API. The loader then reconstructs and injects the malicious payload into the active website. This approach makes the attack particularly deceptive. The malicious traffic can appear to originate from a legitimate Google service.
Why Google Sheets Became Part of the Attack
Google Sheets might seem unrelated to cryptocurrency malware. However, publicly published spreadsheets can provide attackers with convenient data delivery capabilities. Cisco Talos found that the attackers used the Google Visualization API to retrieve JavaScript stored inside spreadsheet cells. The API provides read-only access to publicly published spreadsheet content. Applications can request selected spreadsheet data through specially constructed web requests.
Attackers can therefore use a spreadsheet as a lightweight remote storage location. The browser retrieves the content while communicating with Google’s infrastructure. That creates an unusual challenge for defenders. Blocking every request to Google services would disrupt legitimate business activity.
Instead, security teams must understand the context surrounding those requests. A browser suddenly requesting spreadsheet data during a cryptocurrency transaction deserves additional investigation. The campaign also shows why domain reputation alone cannot determine whether web traffic is harmless.
The Fake Cryptocurrency Opportunity Was the Hook
The criminals did not begin by telling victims to steal cryptocurrency. Instead, they presented an attractive financial opportunity. One campaign version claimed that users could exploit an API flaw for approximately 38 percent higher payouts. Another version promoted a supposed 25 percent loyalty bonus. These claims created a powerful psychological trigger. Victims believed they had discovered information unavailable to ordinary traders.
The attackers then provided detailed technical instructions. Those instructions made the fraudulent opportunity appear more legitimate. The first version targeted SwapZone. Later material focused on SimpleSwap.
The campaign therefore used changing stories while maintaining the same basic infection strategy. This tactic is important because technical language can create false credibility. Terms such as API, exploit, vulnerability, and bonus can sound convincing without proving anything.
From Chrome Address Bars to Browser Extensions
The campaign evolved over several months. Cisco Talos observed early activity beginning around October 2025. Initially, victims were instructed to paste JavaScript directly into Chrome’s navigation bar. The attackers later introduced Tampermonkey to make their approach more persistent. Tampermonkey is a legitimate browser extension used to run user scripts. In this campaign, criminals abused that legitimate functionality.
The victim was instructed to install the extension. They were then told to add malicious code to its configuration. That change increased the attack’s effectiveness. The malicious code could execute again when the victim visited the targeted cryptocurrency website.
Consequently, the attacker did not depend on one isolated browser session. The extension helped maintain the malicious behavior across later visits. This represents a broader security concern. Legitimate browser extensions can become dangerous when users install scripts from untrusted sources.
How the Malware Changes Cryptocurrency Transactions
The injected JavaScript acts like a browser-based web skimmer. It does not necessarily need to infect the operating system directly. Instead, it manipulates what the victim sees and copies inside the browser. The malware can monitor changes within the webpage. It can also alter wallet information displayed by the targeted trading interface. Cisco Talos observed scripts that replaced legitimate deposit addresses with attacker-controlled addresses. The malware also intercepted relevant network responses.
Clipboard manipulation creates another serious risk. A victim may copy an apparently legitimate wallet address from the website. The malicious script can replace that copied value with another address. The victim may then paste the substituted address into their cryptocurrency wallet.
The transaction can look completely normal from the victim’s perspective. However, the funds are directed somewhere else. This method is especially dangerous because cryptocurrency transactions generally cannot be reversed through ordinary banking procedures.
Fake Bonuses Make the Scam Even More Convincing
The malware does more than replace wallet addresses. It can also manipulate elements of the cryptocurrency website. For example, attackers can display fake transaction bonuses. These visual changes reinforce the original story presented by the fraudulent report.
A victim might therefore believe that the promised exploit actually worked. This creates a convincing feedback loop. The fake report creates expectations, while the injected webpage creates apparent confirmation.
The victim then has fewer reasons to question the transaction. Such manipulation demonstrates why website appearance should never be treated as proof of authenticity. A compromised browser session can display information that looks identical to legitimate website content.
The Attackers Hid Their JavaScript in Plain Sight
The Google Sheet did not simply contain readable malicious code. Researchers found heavily obfuscated JavaScript. Some payloads used XOR-based encoding and hexadecimal values. Others combined Base64 encoding with Unicode transformations. The attackers also changed variable names and encoding keys across different versions. Those changes can make simple security signatures less effective.
Interestingly, the spreadsheet content could be visually hidden. Talos observed payload data formatted with white text against a white background. The attackers also pushed older code further down the spreadsheet. This made casual inspection more difficult. However, the malicious content remained accessible through API queries.
Researchers collected 21 unique second-stage payload samples during their investigation. This demonstrates how attackers can combine simple services with basic obfuscation. The result can still create a surprisingly effective delivery system.
Why Browser-Based Malware Is Difficult to Detect
Traditional security tools often focus on files, processes, and executable programs. Browser-based attacks can operate differently. The malicious code may execute inside an otherwise legitimate browser process. Network requests can also travel through familiar cloud infrastructure.
That creates fewer obvious indicators for traditional endpoint defenses. The browser itself becomes the attack environment. Consequently, defenders must monitor user behavior and browser activity more closely.
Security teams should examine unusual browser requests to Google services. They should also investigate suspicious extension installations and unexpected script execution. The broader lesson involves context. A request to Google may be normal in one situation and suspicious in another.
The Campaign Already Moved Through Multiple Infrastructure Changes
Disruption did not permanently stop the operation. After researchers reported campaign infrastructure, the attackers changed their Google-hosted components. They also moved between different hosting arrangements. Cisco Talos reported that blocking the original documents was followed by another version using a new Google Sheet and script. This adaptability makes infrastructure-based blocking less reliable.
Attackers can replace documents while keeping the same social engineering strategy. Therefore, security teams should focus on behavior instead of individual URLs alone.
The campaign also demonstrates the value of rapid threat intelligence sharing. Researchers can identify patterns even when criminals replace individual resources.
How Much Cryptocurrency Did the Attackers Steal?
Cisco Talos identified 49 Bitcoin addresses associated with the operation. Researchers found that 24 addresses received funds. Those addresses collectively received approximately 0.159 BTC. That amount was worth around $10,000 based on early August 2026 valuations. The actual amount could be higher. Researchers did not have every sample from the campaign’s earliest period.
Investigators also observed funds moving through numerous additional addresses. More than 3,000 addresses appeared during later transaction activity.
That movement may have been designed to complicate tracking. However, blockchain transactions remain publicly visible and can support forensic investigations. The financial impact therefore extends beyond the initial wallet transfers.
Why This Threat Could Become Much Bigger
The current campaign focuses on cryptocurrency websites. However, the underlying technique has wider implications. The same browser manipulation could potentially target online banking interfaces. Attackers could also target payment forms, shopping websites, or business applications. A malicious browser extension could modify displayed information without changing the legitimate server itself.
Likewise, compromised third-party JavaScript could alter customer-facing applications. Such techniques resemble broader web-skimming threats. The major concern involves selective manipulation. Attackers do not necessarily need to break an entire website.
They can change one important field at the exact moment a user performs a sensitive action. That makes browser integrity increasingly important for modern cybersecurity.
How Cryptocurrency Users Can Protect Their Wallets
Never paste JavaScript into your browser because an online guide tells you to do so. Likewise, avoid installing browser extensions simply to unlock cryptocurrency bonuses or secret features. Treat claims about guaranteed profits, hidden exploits, and special trading advantages with extreme caution.
Before sending funds, verify the destination address independently. Do not rely solely on the address displayed inside a webpage. Compare it carefully with information from an official and trusted source.
For larger transactions, consider sending a small test amount first. This approach cannot prevent every scam, but it can reduce potential losses. Hardware wallets can also provide additional transaction verification. However, users should still inspect addresses carefully before approving transfers.
What Organizations Should Do About Browser-Based ClickFix Attacks
Businesses should establish clear browser extension policies. Only approved extensions should receive permission to operate in sensitive environments. Security teams should also monitor unexpected developer-related browser behavior. Employees need practical training about copy-and-paste attacks. Security awareness should explain that malicious instructions can appear inside professional-looking documents.
Organizations should also inspect third-party JavaScript dependencies regularly. Unexpected or heavily obfuscated code deserves additional investigation. Customer-facing applications require similar attention. Developers should monitor changes to payment forms, transaction fields, and other sensitive interface elements.
Finally, security teams should correlate browser activity with user behavior. A suspicious spreadsheet request after visiting an untrusted forum can provide useful context.
The Bigger Lesson Behind the Google Sheets Attack
This campaign is not simply another cryptocurrency scam. It demonstrates how attackers can combine social engineering, legitimate cloud services, browser extensions, and JavaScript manipulation. The most dangerous part is the victim’s involvement. The user unknowingly performs an action that gives the attacker access to their browser session. Meanwhile, trusted infrastructure helps hide the malicious activity.
That combination makes ClickFix-style attacks especially relevant for today’s web environment. The safest approach is simple. Never execute code because a stranger promises financial rewards. A browser should not become an attacker’s tool because a fake report appears convincing.
Cryptocurrency users should verify every transaction independently. Organizations should also treat browser security as an important part of their broader defense strategy. As this campaign shows, the next major browser threat may not arrive through an obviously malicious website. It could arrive through a trusted service, a familiar document, or a seemingly harmless instruction.
Conclusion
The Google Sheets cryptocurrency campaign reveals a clever evolution of ClickFix attacks. Instead of targeting the operating system directly, attackers manipulate the browser session itself. They use fake trading opportunities to convince victims to execute JavaScript. Google Sheets then provides a convenient location for retrieving hidden payloads.
Once injected, the scripts can modify wallet addresses, intercept browser data, and manipulate transaction interfaces. The campaign also proves that trusted services can become part of sophisticated attack chains. Therefore, users must evaluate actions, not just websites.
Most importantly, never paste unknown code into a browser. A few seconds of curiosity can turn a legitimate cryptocurrency transaction into an irreversible financial loss.
Frequently Asked Questions
1. What is a ClickFix cryptocurrency attack?
A ClickFix cryptocurrency attack tricks users into executing malicious code through convincing instructions.
2. How does Google Sheets help the attackers?
Google Sheets stores obfuscated JavaScript that the victim’s browser retrieves through Google’s Visualization API.
3. Can the malware change cryptocurrency wallet addresses?
Yes, the observed malware can replace displayed and copied cryptocurrency deposit addresses.
4. Why are browser extensions dangerous in this attack?
Malicious scripts installed through extensions can execute repeatedly when victims revisit targeted websites.
5. What is Tampermonkey’s role in the campaign?
Attackers abused Tampermonkey to load malicious JavaScript into targeted cryptocurrency websites.
6. Can antivirus software detect browser-based attacks?
Some security products can detect related scripts, but browser-based activity can complicate traditional detection.
7. How can crypto users avoid wallet-address hijacking?
Users should verify destination addresses independently and avoid executing unknown browser code.
8. Is Google Sheets itself malicious?
No, the attackers abused a legitimate Google service to deliver their malicious content.
9. How much cryptocurrency did researchers identify?
Cisco Talos identified 49 Bitcoin addresses, with 24 receiving about 0.159 BTC.
10. Could this technique target other websites?
Yes, similar browser manipulation could potentially target payment, banking, shopping, and other web applications.
