ClickFix Campaign Shifts to Browser-Based Cryptocurrency Theft Using JavaScript Injection

A sophisticated cybercriminal operation known as ClickFix has evolved its tactics, moving from instructing victims to execute commands on their operating systems to persuading them to inject malicious JavaScript directly into their web browsers. This new approach, detailed by Cisco Talos, aims to steal cryptocurrency from individuals involved in online trading.

The campaign, which has been active for months and has already survived two disruption attempts, leverages the Google Visualization API to retrieve obfuscated code from publicly accessible Google Sheets documents. This retrieved code is then injected into user sessions on cryptocurrency trading platforms. Researchers alerted Google and the affected websites in April, but the campaign resurfaced with a new spreadsheet and continued to operate despite subsequent reports.

Initially, the ClickFix campaign, starting in October 2025, directed targets to paste JavaScript code into their browser’s navigation bar. By March 2026, the operators began instructing victims to install the Tampermonkey browser extension, followed by adding a specific script. The lures used in these attacks often presented themselves as leaked vulnerability reports for cryptocurrency swap services, promising inflated payouts by describing non-existent API flaws.

Browser Injection Enables Sophisticated Crypto Theft

The appeal of these lures seems to be targeted at individuals willing to exploit perceived flaws, even without full understanding. The campaign material has been observed on platforms like Telegram and DarkForums, with regular waves of messages sent at least twice a month.

The use of the Google Visualization API is particularly effective because it provides free, unauthenticated, read-only access to any Google Sheets document published online. This allows the malicious requests to originate from the victim’s own browser, making them appear as normal web traffic. The attackers concealed their malicious code within spreadsheet cells by formatting the text to match the background colour.

Cisco Talos identified 21 distinct second-stage payloads retrieved from these spreadsheets. While these payloads were often rotated with fresh encryption keys and randomised variable names, their core functionality remained consistent. The injected scripts were designed to monitor changes on the targeted webpages, subtly replacing displayed cryptocurrency deposit addresses with those controlled by the attackers. They also manipulated transaction amounts, suggesting a bonus had been applied, and overrode the browser’s fetch API to ensure attacker wallet addresses were substituted into deposit responses before the data reached the user interface.

Furthermore, a clipboard function was implemented to replace any cryptocurrency address the victim copied with an attacker-controlled address. For versions involving the Tampermonkey extension, the malicious code would reload on every visit to the targeted website, ensuring continuous monitoring and manipulation.

Talos traced 49 Bitcoin addresses associated with the campaign. A significant portion of the samples analysed, dating from April to late June, drew from a set of 30 addresses, of which 24 reportedly received victim funds totalling approximately 0.159 BTC, estimated to be around $10,000 at early August valuations. The actual proceeds are believed to be higher, with funds being routed through multiple subsequent wallets and then over 3,000 addresses, suggesting a complex mixing operation designed to obscure the origin of the stolen funds.

While the campaign does not pose a direct threat to most organisations, the techniques employed highlight the growing risk of browser-based attacks. Talos advises organisations to restrict the installation and use of browser extensions based on user roles and to monitor browser sessions for suspicious requests to Google Docs.