- Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session.
- The actors use a variation on ClickFix social engineering. Instead of convincing targets to run commands against the operating system, they convince targets to paste JavaScript into the Chrome address bar or install it into the Tampermonkey browser extension, which also provides persistence.
- The lure poses as a leaked vulnerability report describing a nonexistent API flaw at cryptocurrency swap services, and is aimed at users willing to exploit it for financial gain. Talos observed lures distributed through Telegram, DarkForums, and paste sites.
- The injected script functions as a web skimmer. It hooks the browser's fetch API, replaces cryptocurrency deposit addresses in server responses and the user's clipboard, and displays counterfeit "bonus" interface elements.
Cisco Talos has recently observed a criminal campaign that leveraged an interesting twist on what we refer to as “legitimate service abuse.” In this monthslong campaign, the criminal actors used the Google Visualization API as part of a scheme to inject malicious JavaScript into two cryptocurrency trading websites.
This campaign uses a twist on the tactics associated with “ClickFix” social engineering attacks, in which targets are manipulated into copying and pasting PowerShell or other commands and executing them to launch malware. Rather than targeting the victim device’s OS, the actors behind this campaign aim to convince the user to inject malicious code into their own browser session.
Early versions of this campaign began in early October 2025. The social engineering lures used initially focused on getting targets to paste a code snippet directly into the Chrome web browser’s navigation bar; the latest version relies on a legitimate Chrome plugin, Tampermonkey, to inject a loader script pasted in by the user and provide persistence across sessions with the current targeted site.
In March 2026, the actors behind the campaign began using the Google Visualization API to deliver malicious scripts stored in a Google Sheets document. In July, after frequent disruption of their posts on shared text sites, the actors moved to hosting all the components of their campaign in Google Docs and Google Sheets.
So far, the actors behind the scheme have largely targeted individuals who frequent web discussion boards and forums focused on cryptocurrency trading, software development, basic cybersecurity, and hacking. The lure used in the campaign is designed to appeal mostly to would-be cybercriminals looking to make a quick profit off an “API vulnerability” that doesn’t exist to get bigger payouts on cryptocurrency trades.
While this campaign doesn’t pose a specific threat to most organizations, the approaches that the actors here are using do. These techniques and tools could be leveraged in other malware and web attacks with much wider impact, including supply-chain attacks on e-commerce sites and other customer-facing systems.
Just Google it
Google application abuse for C2 is not new by any stretch of the imagination. There have been multiple cases of state-sponsored actors using Google Sheets APIs, Google Drive, and other Google cloud services to help control deployed malware, concealing communications within traffic to otherwise trusted network spaces.
Hunting for these threats usually requires examination of DNS traffic and the processes that are making the requests to reach these destinations — like a random executable making a DNS request for “docs.google[.]com”. But when the requests are made from within a browser session, that makes detection much more difficult.
The Google Visualization API is a feature of Google Docs that is almost as old as the platform itself. Initially introduced in 2008, the API provides free, unauthenticated read-only access to the contents of any Google Sheets spreadsheet that has been publicly published to the web via queries embedded in a URI. These queries result in delivery of data from within the spreadsheet in JSON format or as an HTML table.
A Visualization API request URI looks like this:
https[:]//docs.google[.]com/spreadsheets/d/[document identifier] /gviz/tq?[query language input formatted for HTTP]
The API’s query language is very similar to Structured Query Language (SQL). For example, to get all of the content from a sheet’s column B returned as a JSON object, the query portion of the URI would be:
/gviz/tq?tqx=out:json&tq=SELECT%20B
API responses in JSON are returned in the format like the one below, ready to be parsed by the calling JavaScript application:
This is a read-only API, so it can’t be used by an application to alter the data in the spreadsheet. However, an application could append to the data to a spreadsheet connected to a Google Forms page by sending an HTML POST request. Presto! A full C2 system hidden within HTTPS traffic to a trusted domain.
The campaign Talos observed used the Visualization API to retrieve two cells from a remote spreadsheet containing obfuscated JavaScript, which were injected into the web browser session of a target. Used in combination with other abused legitimate services, the actors behind this campaign could modify the query used to change which cells were retrieved and injected, or if necessary change the spreadsheet targeted by the query — which they did after we disrupted their operations the first time.
Phishing for sharks
The actors behind this scheme are looking for a very specific kind of mark: someone who is willing to commit fraud using technical means that they don’t clearly understand. Early versions of their phishing campaign documented by researchers used email, carrying links to a Google Docs document purportedly leaked security report. Actors also used comments on Pastebin and other text-sharing sites and direct messages in various forums to post links to versions of the Docs file.
In January, operators of the most recent incarnation of the scheme set up a Telegram account to facilitate the scam. The Telegram channel only allows posts from the channel administrator, and the threat actors delete older posts each time a new version of the lure is published to disguise the fact that they’re essentially just reposting the same fictional “exploit” over and over again.
Talos found multiple lures related to this Telegram channel posted in dark web forums, including the cybercrime-focused DarkForums. Lures were also posted in the comments on text files shared on Pastebin and a number of other text-sharing sites. Some (like the one above) directed recipients to a Telegram channel, while others linked directly to a Google Docs document promoted in the Telegram channel.
Waves of these messages were sent out at least twice a month, coinciding with new postings on the Telegram channel.
Baiting the hook
Talos saw two variants of the Google Docs document linked in the phishing messages. Both used the same “docs.google[.]com” URL and the same file name (“API Logic Flaw”). The first was active from April 12 – 16, 2026; the second was active starting at least as early as April 19 and remained active as of July 22, despite it being reported to Google through multiple channels.
The initial version we observed targeted the cryptocurrency trading site “SwapZone[.]io”. It was formatted in the style of a vulnerability report and discussed a purported weakness in an older version of the ChangeNOW cryptocurrency exchange’s API allegedly still exposed through SwapZone; if accessed, the report claimed, it would result in “~38% higher payouts” on trades of Bitcoin for other cryptocurrencies.
All the reader had to do to leverage this mythical old API, according to the lure document, was copy the script shared through a “paste[.]sh” link into the navigation bar of the Chrome browser preceded by “javascript:”.
On April 18, Talos observed a new revision of the lure document. The new lure used the same “docs.google[.]com” URL as the previous lure but was rewritten to target a different trading site — “SimpleSwap[.]io”, another cryptocurrency trading aggregator. The fake exploit this time was a flaw in a “loyalty bonus” function that allegedly triggered a 25% boost in the value of the trade, according to the updated lure document.
This wasn’t the only revision to the lure. In the new version, instructions were given to install the Tampermonkey browser extension from the Chrome Web Store to activate the “bonus.”
The instructions then directed the targets to a link to a new source script on “paste[.]sh” to be added to the plugin (“https[:]//paste[.]sh/dQfdExjo#AqjB4BBt]lwLt2NKrlC0x8J9O”). The plugin would activate the script whenever the user visited “SimpleSwap[.]io”.
Reeling them in: First-stage scripts
Aside from their means of being executed by the user, both versions of this campaign’s first-stage loader script contained strings that do essentially the same thing. They both connected to the same Google-hosted spreadsheet via the Visualization API, retrieving blocks of code from different pairs of cells within the sheet.
The initial version of the script depended on direct user execution of the script within Chrome. Targets were instructed by the lure to copy the script from the “paste[.]sh” URL and paste it directly into Chrome’s navigation bar preceded by “javascript:” which results in the execution of the script within the context of the current web page.
The address of the Google Docs spreadsheet is plainly visible in the sample, and the JavaScript containing it swaps it for the fictitious vulnerable API’s URL to construct the Visualization API URL to retrieve the second stage script from:
This results in the Visualization API call to:
The script used in the second version of the lure was intended to be pasted into the Tampermonkey browser plugin’s configuration. It was somewhat more obfuscated than the first:
In this script, the URL needed for the visualization API call is hidden within the fake SimpleSwap API address, encoded in Base64:
When decoded, the block of text after “bonus” becomes:
In both cases, the generated request for the site comes from the Chrome browser and would have appeared as legitimate web traffic. Both scripts then concatenate the retrieved blocks of JavaScript, reconstruct the full second-stage JavaScript payload, and inject into the browser session.
In the first version, this is a bit more involved: The script explores the document object model of the web page looking specifically for script elements associated with browser extensions. If it finds more than one script associated with Chrome extensions, it picks a random one to inject the payload into. If no extensions are found, it picks a random