Click Fix moves into the browser: Cryptocurrency theft with Google-hosted C2
Summary: Cisco Talos documented a monthslong criminal campaign, starting in early October 2025, that abuses the Google Visualization API to pull obfuscated JavaScript from cells in a Google Sheets document and inject it into victims' browser sessions on cryptocurrency trading sites. The lures, hosted in Google Docs under the file name "API Logic Flaw" and promoted through Telegram, Pastebin and dark web forums, promise a fake API flaw worth roughly 38% higher payouts on SwapZone and a 25% loyalty bonus on SimpleSwap, and by July 2026 the actors had moved all campaign components into Google Docs and Sheets.
Why it matters: The command-and-control traffic comes from the victim's own Chrome browser to docs.google.com, so the DNS and process-level hunting that catches a random executable calling out to Google does not apply here. Talos notes the same techniques could be turned on e-commerce sites and other customer-facing systems in supply-chain attacks with far wider impact.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026