The lure is a leaked vulnerability report. It describes an API flaw at cryptocurrency swap services that would let anyone who knew about it squeeze a bigger payout out of a trade. The flaw does not exist. Anyone who follows the instructions pastes a script into their own browser and installs a skimmer that quietly swaps the deposit addresses they are about to send money to.
The mark, in other words, is not a careless employee. It is someone trying to commit fraud.
Cisco Talos, in research published by Sean Gallagher, has tracked the campaign for months across two cryptocurrency trading websites. The lures circulate on Telegram, on the cybercrime forum DarkForums and on text-sharing sites.
ClickFix without the command prompt
ClickFix attacks normally work by talking a target into copying a PowerShell command and running it on their machine. This campaign never touches the operating system. Early versions asked the target to paste a snippet straight into the Chrome address bar. The current version has them install it into Tampermonkey, a legitimate Chrome extension for user scripts, which usefully makes the injection persist across sessions on the targeted site.
What gets injected is a web skimmer. It hooks the browser's fetch API, the function pages use to talk to their own servers, then rewrites cryptocurrency deposit addresses in the responses that come back and in the user's clipboard, and paints fake "bonus" elements into the interface so the numbers look right.
Command and control inside a public spreadsheet
The part defenders should look at twice is where the script comes from. The actors use the Google Visualization API, a feature of Google Docs introduced in 2008 that gives free, unauthenticated, read-only access to the contents of any spreadsheet published to the web, through a query embedded in the URL. The campaign pulls two cells of obfuscated JavaScript out of a Google Sheet and injects them into the browser session. The API is read-only, but an application can append data to a spreadsheet connected to a Google Form by sending a POST, which closes the loop into a working command channel carried entirely over HTTPS to a domain nobody blocks.
Talos makes the detection point plainly. Hunting Google abuse usually means spotting a random executable making a DNS request for docs.google[.]com. When the request comes from inside a browser session, that signal disappears.
Blocked in April, back in a week
The operation has proved hard to disrupt. It began in early October 2025, moved to the Visualization API in March 2026, and by July had every component sitting in Google Docs and Sheets. Talos shared its findings with the targeted websites and with Google in April, and the lure and command documents were blocked. A week later the campaign was running again on a new sheet and another paste site script, at a slightly reduced rate of victim recruitment. When the administrator of paste[.]sh started detecting the first-stage script signature automatically in July, the actors moved that stage into a Google Docs document too. Talos records the replacement documents as reported but still active on August 11.
Talos is careful about the proceeds. It traced funds out through 30 further wallets and then through more than 3,000 addresses in what it assesses is likely a Bitcoin mixing operation, and says its wallet list may not cover every variant.
The technique outlives the scam
Talos judges that the campaign itself does not pose a specific threat to most organizations. The technique does. Classic web skimming of the Magecart kind depends on compromising a supply chain to inject code into a legitimate site, and access to compromised code bases is increasingly for sale, from groups such as TeamPCP. Pair that access with a channel that looks like ordinary traffic to a Google document, and a defender watching network telemetry just sees a browser talking to Google.
Indicators from the campaign include the first-stage script hosted at hxxps://paste[.]sh/dQfdExjo#AqjB4BBt and Visualization API requests of the form hxxps://docs.google[.]com/spreadsheets/d/[document identifier]/gviz/tq?[query].
ClickFix keeps working because it asks the target to do the dangerous part themselves, whether that is a loader hidden behind a fake game download or a wallet safety check that drains the wallet. Moving it into the browser removes the last obvious tell, which was a console window appearing where none should be.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.