In-Browser ClickFix Abuses Google Sheets C2 to Steal Crypto

Cisco Talos has published an in-depth threat spotlight uncovering a sophisticated cybercrime campaign that shifts ClickFix social engineering tactics directly into the victim's web browser. While traditional ClickFix attacks coerce users into pasting malicious PowerShell or MSHTA scripts into the Windows Run prompt, this campaign tricks users into injecting malicious JavaScript into active browser sessions.

The adversary abuses the Google Visualization API and publicly published Google Sheets as a covert command and control (C2) mechanism. By blending C2 payload retrieval into legitimate Google Docs HTTPS traffic, the threat actors deploy in-browser web skimmers to hijack cryptocurrency transactions on platforms including SimpleSwap.io and SwapZone.io.

Technical Analysis

The campaign demonstrates a notable evolution in Living-off-the-Cloud (LotC) techniques, combining social engineering, unauthenticated cloud APIs, and browser DOM manipulation:

Abusing the Google Visualization API for C2

The operators host their obfuscated JavaScript payloads directly inside publicly accessible Google Sheets spreadsheets. Rather than maintaining custom C2 servers that trigger threat intelligence blocks, the malware queries the Google Visualization API:

• Endpoint Structure: Requests are routed to docs.google.com/spreadsheets/d/[Doc_ID]/gviz/tq?tqx=out:json&tq=SELECT...
• Query Execution: The loader issues SQL-like Visualization API queries (such as retrieving specific cell ranges) to fetch obfuscated JavaScript blocks packaged as JSON responses.
• Anti-Analysis Formatting: In the spreadsheet itself, payload text is disguised by formatting font colors as white-on-white and positioned hundreds of rows down to evade casual inspection while remaining queryable via the API.

Multi-Stage Loader Evolution

Talos documented two operational phases of the browser infection vector:

• Phase 1 (Address Bar Injection): Victims were instructed to copy a JavaScript snippet from paste.sh and paste it directly into Chrome's address bar prefixed with javascript:, executing the code immediately in the context of the active trading page. The script scanned the DOM for existing browser extensions and hooked a random script element to inject the payload.
• Phase 2 (Tampermonkey Extension Persistence): The threat actor transitioned to instructing targets to install the legitimate Tampermonkey browser extension from the Chrome Web Store. Victims configured a malicious userscript that automatically executes whenever they visit SimpleSwap.io, establishing multi-session persistence.

In-Memory Reassembly & Obfuscation

The retrieved payload chunks are decoded and reassembled dynamically in the browser session. Obfuscation techniques include paired XOR operations, variable renaming using tools like Obfuscator.io, and Unicode character escaping to hinder static inspection.

Attack Vector & Impact

The campaign specifically targets cryptocurrency traders and dark web forum participants using a tailored social engineering lure:

• The "API Logic Flaw" Lure (T1204.001): The actors distribute fake leaked vulnerability reports across Telegram, DarkForums, and Pastebin, claiming an unpatched API flaw in swap aggregators allows users to receive 25% to 38% bonus payouts on Bitcoin trades. Would-be opportunists seeking to exploit the fake flaw inadvertently compromise their own sessions.
• API Response Manipulation (T1185): The injected script overrides the browser's native fetch API. When the user initiates a swap, the malware intercepts JSON responses from deposit endpoints and substitutes legitimate recipient addresses with attacker-controlled addresses.
• Counterfeit UI Elements: The script uses MutationObserver to alter page elements (such as data-testid="recipientAddressContainer" and data-testid="depositAddress"), rendering fake "Loyalty Bonus Active" banners to reinforce the deception.
• Clipboard Hijacking (T1115): When a victim copies an address to their clipboard, the script intercepts the event and substitutes the text with one of 49 rotating attacker-controlled Bech32 Bitcoin addresses.
• Cryptocurrency Siphoning: Talos tracked at least 24 compromised deposit addresses receiving stolen funds, which were subsequently funneled through mixing services involving over 3,000 intermediate wallet addresses.

Detection & Mitigation

Security teams and enterprise network defenders must account for browser-level code execution and cloud API abuse:

Enterprise Browser Controls

• Restrict Extension Installations: Enforce organizational browser management policies restricting third-party browser extensions (including userscript managers like Tampermonkey) strictly to approved administrative lists.
• Disable DevTools & Address Bar Scripting: For high-risk endpoints, disable browser developer tools and execution of javascript: URI schemes from the navigation bar via Google Chrome Enterprise administrative templates (GPO / MDM).

Threat Hunting & Network Monitoring

• Anomalous Google Sheets Queries: Monitor web proxy and EDR network telemetry for outbound HTTP GET requests targeting docs.google.com/spreadsheets/.../gviz/tq originating from browsers not actively interacting with Google Docs or initiated by unauthorized background scripts.
• Clipboard Auditing: Deploy endpoint detection rules to identify anomalous rapid clipboard modifications occurring within browser processes.
• User Awareness Training: Educate personnel on browser-targeted ClickFix lures, emphasizing that pasting code into address bars or extension managers carries the same risk as running untrusted desktop executables.