A ClickFix campaign has pivoted from convincing victims to execute commands on their operating systems to persuading them to insert harmful JavaScript directly into their web browsers, according to research published September 8 by Cisco Talos. The months-long operation used Google's Visualization API to pull hidden code from a publicly available Google Sheets document and inject it into user sessions on two cryptocurrency trading platforms. The campaign has withstood two takedown efforts: Talos notified Google and the affected sites in April, but the operation reappeared one week later using a different spreadsheet, and as of August 11 the replacement documents had been flagged again but remained active.

The campaign launched in October 2025 with lures that instructed targets to paste JavaScript into Chrome's address bar. By March 2026, the operators incorporated the Visualization API, and from mid-April onward they directed victims to install the Tampermonkey browser extension before adding a script. The bait came disguised as leaked vulnerability reports describing fake API flaws at cryptocurrency swap services, offering payouts up to 38% higher than normal rates. Talos collected 21 second-stage payloads from the spreadsheet, rotated with new XOR keys and randomized variable names but functionally identical. The researchers identified 49 Bitcoin addresses across the campaign, with most samples decoded from April through late June drawing on one set of 30 addresses, of which 24 received victim funds totaling 0.159 BTC—approximately $10,000 at early August valuations. The actual figure is likely higher, Talos noted, as proceeds were routed through 30 additional wallets and then more than 3,000 addresses in what appeared to be a mixing operation.

The scripts monitored page changes, swapped displayed deposit addresses, and modified transaction amounts to imply a bonus had been applied, according to the report. They also overrode the browser's fetch API, replacing attacker wallet addresses into deposit responses before the data reached the page, and a clipboard function substituted any address the victim copied. On the Tampermonkey version, the code reloaded on every visit to the targeted site. Talos said the campaign's appeal was to readers prepared to exploit a flaw they didn't understand, and the material was found on Telegram, the cybercrime forum DarkForums, and text-sharing sites, with waves of messages sent at least twice a month.

The Visualization API provides free, unauthenticated read-only access to any Google Sheets document published to the web, so the request originated from the victim's own browser and looked like ordinary web traffic—making detection difficult. The operators concealed the payload cells by formatting the text white on white, rendering it invisible in the spreadsheet view. Talos said the campaign posed no specific threat to most organizations but that the techniques did, and advised restricting browser extensions by role and monitoring browser sessions for requests to Google Docs. The real risk isn't the cryptocurrency angle—it's the proof that social engineering can now turn a user's browser into a fully compromised environment without ever touching the underlying system. For security teams, that shifts the perimeter inward to a layer most defenses weren't built to watch.