ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
A fake vulnerability report tricks crypto traders into installing malicious JavaScript in Chrome. The attacker then steals their crypto by swapping deposit addresses and copying fake 'bonus' buttons into their clipboard.
- Severity
- Not scoredNo CVSS score recorded
- Affects
How it works
- Attackers send fake messages on Telegram, DarkForums, and paste sites.
- These messages pretend to reveal a fake vulnerability in crypto swap services.
- They trick users into pasting malicious JavaScript into Chrome's address bar or installing it via the Tampermonkey extension.
- The script hooks Chrome's fetch API to replace real crypto deposit addresses with attacker-controlled ones.
- It also copies fake 'bonus' buttons into the user's clipboard, tricking them into sending crypto to the attacker instead of the intended recipient.
What to do
If you installed Tampermonkey or pasted JavaScript from a fake vulnerability report into Chrome's address bar, check your installed extensions in Chrome's settings under Extensions. Look for Tampermonkey or any unfamiliar scripts. If you see anything suspicious, remove it immediately.
Remove Tampermonkey and any unfamiliar extensions from Chrome. Avoid pasting JavaScript from untrusted sources into Chrome's address bar. Check your crypto deposit addresses and clipboard for any suspicious changes. If you suspect your crypto was stolen, contact your exchange or platform immediately.
Technical details
Affected software: Google
A cryptocurrency theft campaign abuses the Google Visualization API for command-and-control, injecting malicious JavaScript into victims' browsers via a ClickFix-style social engineering attack. Attackers lure targets with fake "leaked vulnerability reports" claiming to expose flaws in cryptocurrency swap services, enticing users to exploit them for financial gain. The malicious payload, hosted in a public Google Sheets document, hooks the browser's fetch API to replace cryptocurrency deposit addresses in web responses and the user's clipboard, while also displaying fake "bonus" prompts.
The campaign began in early October 2025, initially using direct JavaScript pasting into Chrome's address bar, later shifting to the Tampermonkey extension for persistence. The Google Sheets-based delivery method emerged in March 2026. Distribution occurs via Telegram, DarkForums, and paste sites.