Full Report
Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session.
Analysis Summary
# Tool/Technique: Google Visualization API Abuse (ClickFix Variant)
## Overview
This technique involves leveraging the **Google Visualization API** as a Command and Control (C2) mechanism to deliver malicious JavaScript. Attackers host obfuscated code within publicly published Google Sheets and use social engineering to trick victims into injecting this code into their browser sessions. The primary goal is the theft of cryptocurrency through DOM hijacking and web skimming.
## Technical Details
- **Type:** Technique (C2 Abuse) / Malware (Web Skimmer/Loader)
- **Platform:** Web Browsers (Chrome, specifically leveraging the Tampermonkey extension)
- **Capabilities:** JavaScript injection, persistence via browser extensions, real-time C2 retrieval, DOM manipulation, and data skimming.
- **First Seen:** Early October 2025 (Initial social engineering); March 2026 (Transition to Google Visualization API).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.003 - Phishing: Spearphishing Service (Telegram/Forums)
- **TA0002 - Execution**
- T1204.001 - User Execution: Malicious Link
- T1059.007 - Command and Scripting Interpreter: JavaScript
- **TA0003 - Persistence**
- T1176 - Browser Extensions
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information
- T1564.008 - Hide Artifacts: Email Hiding Rules (Indirectly via legitimate service abuse)
- **TA0011 - Command and Control**
- T1102.002 - Web Service: Bidirectional Communication (Google Sheets)
- T1071.001 - Application Layer Protocol: Web Protocols
## Functionality
### Core Capabilities
- **Legitimate Service Abuse:** Uses `docs.google[.]com/spreadsheets/d/[ID]/gviz/tq` to fetch malicious payloads, bypassing domain-based reputation filters.
- **Social Engineering (ClickFix):** Lures users under the guise of an "API vulnerability exploit." Victims are directed to copy-paste code into the browser address bar or Tampermonkey.
- **Web Skimming:** Hooks the browser's `fetch` API to intercept data.
- **Address Substitution:** Monitors for cryptocurrency deposit addresses in the DOM or clipboard and replaces them with attacker-controlled addresses.
### Advanced Features
- **Dynamic Persistence:** Uses the Tampermonkey extension to ensure the malicious script executes automatically every time the victim visits targeted cryptocurrency exchange sites.
- **UI Manipulation:** Injects counterfeit "bonus" interface elements into legitimate trading sites to further deceive the user.
## Indicators of Compromise
- **File Names:** Tampermonkey scripts (user-defined names), typically containing obfuscated JavaScript loaders.
- **Network Indicators:**
- `docs.google[.]com/spreadsheets/d/*`
- Requests containing `/gviz/tq?tqx=out:json`
- **Behavioral Indicators:**
- Browser extensions making unauthorized calls to Google Sheets APIs.
- Unexpected modifications to the DOM on cryptocurrency exchange domains.
- Manual entry of `javascript:` code into the Chrome Omnibox.
## Associated Threat Actors
- **Unknown:** Currently tracked as a financially motivated campaign targeting cryptocurrency users and "would-be" cybercriminals.
## Detection Methods
- **Signature-based detection:**
- ClamAV: `Js.Downloader.ClickFix-10060510-0`
- **Behavioral detection:**
- Monitoring for HTTP requests to `docs.google[.]com` initiated by browser extensions or non-Google web pages.
- Identifying `fetch` API hooking within the browser environment.
- **YARA:** Rules focusing on the Google Visualization API URI structure combined with JavaScript obfuscation patterns.
## Mitigation Strategies
- **Browser Management:** Implement Group Policy Objects (GPO) to restrict the installation of unapproved browser extensions (e.g., Tampermonkey) and disable "developer mode" features for standard users.
- **Network Filtering:** Inspect DNS and HTTP traffic for unusual Google Docs API queries originating from scripts rather than user-initiated document editing.
- **User Education:** Train users to never copy and paste code (specifically `javascript:` strings) into their browser address bar or extension managers.
- **Content Security Policy (CSP):** Website owners should implement strict CSPs to prevent the execution of inline scripts and restrict the domains from which scripts can be loaded.
## Related Tools/Techniques
- **ClickFix:** The original technique where users are tricked into running PowerShell commands via the Windows Run dialog or Command Prompt.
- **EtherHiding:** A similar technique using blockchain smart contracts to host malicious code.
- **Magecart:** General category of web-based supply chain attacks and skimmers.