Reported by 3 outlets

Timeline

1. original reporting

   ClickFix Campaign Abuses Google Sheets C2 to Inject Malicious JavaScript Into Chrome

   cyberpress.org · 34d ago · September 9th, 2026

   Cisco Talos has uncovered a cryptocurrency theft campaign that abuses Google Sheets and the Google Visualization API as a command-and-control (C2) channel. The attackers use ClickFix-style social engineering to convince victims to execute malicious JavaScript inside their own Chrome browser sessions. Unlike traditional ClickFix attacks , which trick users into pasting PowerShell commands into Windows Run dialogs or terminals, this operation targets the browser directly. Victims are instructed to paste JavaScript into Chrome’s address bar or install the Tampermonkey browser extension and add a supplied script. The campaign targets cryptocurrency users through fake vulnerability reports claiming to expose profitable flaws in crypto swap services. The reports promise larger payouts by exploiting nonexistent API issues. Talos observed the lures on Telegram, DarkForums, Pastebin comments, and other text-sharing platforms. ClickFix Abuses Sheets C2 The attackers use the Google Visualization API to retrieve malicious JavaScript stored in publicly published Google Sheets documents. The API allows read-only access to spreadsheet data through URLs hosted on docs.google.com , helping the attackers blend their traffic with legitimate Google services . Telegram channel post promoting the “API Exploit” lure document (Source: talosintelligence) The first-stage JavaScript loader queries selected spreadsheet cells, retrieves obfuscated payload fragments, combines them, and injects the resulti

2. update from securityonline.info

   A ClickFix browser attack uses Google Sheets C2 to inject a crypto web skimmer into Chrome. See how Cisco Talos traced the theft. # ClickFix

   securityonline.info · 34d ago · September 9th, 2026

   A ClickFix browser attack uses Google Sheets C2 to inject a crypto web skimmer into Chrome. See how Cisco Talos traced the theft. # ClickFix

   via Mastodon https://securityonline.info/clickfix-browser-attack-crypto-theft/?utm_source=mastodon&utm_medium=jetpack_social

3. update from gbhackers.com

   Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency

   gbhackers.com · 34d ago · September 9th, 2026

   The operation marks a significant evolution of ClickFix social engineering: rather than persuading users to execute PowerShell commands or install malware on an operating system, attackers manipulate them into running […] The post Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .