Do Son 
A screenshot of a private message on a dark web forum linking to the Telegram channel operated by the scammers
At a Glance
| Malware type | Browser-injected web skimmer |
| Threat actor | Unattributed; linked to “The Protocol One” persona |
| Targets | Crypto traders using SwapZone and SimpleSwap |
| Delivery vector | ClickFix-style lures on Telegram, DarkForums, paste sites |
| Key capabilities | Google Sheets C2, address swapping, clipboard hijacking |
| Source | Cisco Talos |
TL;DR
Cisco Talos uncovered a crypto-stealing campaign that turns the ClickFix browser attack into a web skimmer. Attackers trick users into pasting JavaScript into Chrome or Tampermonkey. The code then pulls hidden payloads from a Google Sheets document and swaps crypto deposit addresses.
What Happened
Talos tracked this campaign for months. The operators abused the Google Visualization API for command and control. They stored obfuscated JavaScript in a published Google Sheet and injected it into victim browsers.
This marks a shift in the ClickFix browser attack model. Classic ClickFix lures push victims to run PowerShell against the operating system. Here, the actors instead convince targets to compromise their own browser session.
A Lure Aimed at Would-Be Cheaters
The bait poses as a leaked report for a fake API flaw at crypto swap services. It targets users hoping to exploit it for profit. Talos notes the lure appeals to “would-be cybercriminals looking to make a quick profit off an API vulnerability that doesn’t exist.”
Operators spread it through Telegram, the cybercrime forum DarkForums, and paste sites. Waves went out at least twice a month. One version promised roughly 38% higher payouts; another dangled a bogus 25% loyalty bonus.
Delivery and the Infection Chain
Early lures told victims to paste a snippet into Chrome’s address bar after “javascript:”. Later versions used the Tampermonkey extension instead. That change gave the attackers persistence across sessions.
Once active, a first-stage loader contacts the Google-hosted spreadsheet. It reads specific cells through the Visualization API. Then it rebuilds and injects a second-stage payload into the page.
The actors hid payloads by coloring text white on a white background. They also added rows to push hidden cells down the sheet. Consequently, the data stayed invisible without a text search or API query.
Command and Control Through a Trusted Domain
The Visualization API dates back to 2008. It gives free, unauthenticated read access to any published sheet. Because requests go to docs.google.com, they blend into normal web traffic.
Talos explains why this matters for defenders. Hunting these threats usually means watching which process makes a request. However, “when the requests are made from within a browser session, that makes detection much more difficult.” The full Talos analysis of the ClickFix browser attack details how the Google Forms path could even enable two-way C2.
Data Theft Behavior
The injected script works as a web skimmer. It hooks the browser’s fetch API to inspect wallet and deposit responses. When it spots a crypto address, it swaps in an attacker-controlled one.
The malware also watches the page with MutationObserver. It rewrites displayed deposit addresses and fakes bonus amounts. Additionally, it hijacks the clipboard when a victim copies an address.
How Much Was Stolen
Talos identified 49 Bitcoin wallet addresses tied to the scheme. Of 30 common addresses, 24 received victim funds. Those totaled about 0.159 BTC, or roughly $10,000 in early August 2026.
The real haul is likely higher. Researchers could not find samples from before April. Funds later moved through more than 3,000 addresses, which points to a mixing operation.
Why This Threat Is Hard to Kill
Talos alerted Google and the targeted sites in April. The documents were blocked. A week later, the campaign returned with a fresh sheet and script.
The attribution stays open. The lures reference a “The Protocol One” persona, but no confirmed actor is named. As of mid-August 2026, reported Google documents remained active.
Detection and Defense Guidance
The bigger risk lies in reuse. These methods could power supply-chain attacks on e-commerce sites. A corrupted browser plugin using Google Docs for C2 would be tough to spot.
To reduce exposure, organizations should manage browser use by role. Limit developer features and extension installs. Also monitor for unexpected requests to docs.google.com from browser sessions with no other Google Docs activity.
Teams should review third-party web dependencies for out-of-place obfuscated script. Finally, warn staff and customers about pasting code they do not understand. That single habit defeats most ClickFix browser attack attempts.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
