A campaign named ClickFix has moved from tricking users into running commands on their computers to convincing them to inject malicious JavaScript into their own browsers, with the aim of fraud in the cryptocurrency sector. Cisco Talos researchers published findings on 8 September detailing how the operation used the Google Visualization API to pull obfuscated code from a public Google Sheets document and inject it into sessions on two cryptocurrency trading sites.
The attackers have weathered two disruption attempts, with Google and the targeted sites notified in April and a follow-up campaign appearing a week later on a new spreadsheet; as of 11 August the replacement documents were still live.
How it works and what was affected: the attackers shifted from OS-level delivery to browser-based manipulation. From October 2025, targets were asked to paste JavaScript into Chrome’s navigation bar; in March 2026 the Visualisation API was added, and from mid-April victims were told to install the Tampermonkey extension.
The injected scripts monitored page changes, replaced deposit addresses and altered transaction amounts to imply a bonus, and overrode the browser’s fetch API to substitute attacker wallet addresses in deposit responses. A clipboard function replaced copied addresses. In Tampermonkey deployments, the code reloaded on every visit to the site.
Talos found 49 Bitcoin addresses across the campaign, with most samples (covering April to late June) drawn from a set of 30 addresses; 24 victims sent funds totalling about 0.159 BTC (roughly $10,000 at early August values). Proceeds reportedly moved through 30 additional wallets and more than 3,000 addresses in what appears to be a mixing operation.
The researchers note the campaign poses a generic risk to users and some organisations, recommending restricts on browser extensions by role and monitoring for requests to Google Docs.