ClickFix: A Fake Exploit Report That Hides a Crypto Skimmer in Google Sheets

A ClickFix campaign has moved into the browser: victims paste JavaScript into their own browser, and that script reads a hidden second stage from a public Google Sheet, so the command channel is a trusted Google address and the victim runs the attack.

ClickFix is a social engineering technique in which a fake message or page persuades the victim to run attacker-supplied code themselves, so that no exploit, attachment or installer is needed. In this campaign the code goes into the browser rather than into a Windows command prompt.

Analysis based on Infosecurity Magazine's report of 9 September 2026 and on Cyber Security News coverage, which describe a vendor research report published on 8 September. The campaign has been active since October 2025 against crypto swap services, according to the reporting. Threat Watch covered another user-assisted lure, SynkLoader, in October.

How does the ClickFix Google Visualization API command channel work?

The reporting describes five steps. Steps 1 to 3 describe the lure and the paste; steps 4 and 5 describe what the pasted code does.

1. A message on Telegram, the DarkForums cybercrime forum or a text-sharing site links to a lure document. The first version was a Google Doc named "API Logic Flaw".
2. The document poses as a leaked vulnerability report describing a non-existent API flaw at a crypto swap service, and promises payouts up to 38 percent higher. A later version used a fabricated SimpleSwap loyalty bonus worth 25 percent.
3. The reader is told to paste a short script into Chrome's address bar or, in the later version, to install the Tampermonkey extension and paste a loader into it. Cyber Security News says the loader was hosted on the paste.sh text-sharing site.
4. The loader calls the Google Visualization API to read the second stage out of the cells of a public Google Sheet, joins the pieces and injects the result into the open page.
5. The injected script acts as a web skimmer on the targeted swap site, and in the Tampermonkey version it reloads on every visit to that site.

What the second-stage script does

The script overrides the browser's fetch function so it can rewrite server responses that contain deposit addresses before the page sees them, replaces any address the victim copies to the clipboard, and watches the page for changes so the substitutions persist. It also alters transaction amounts to suggest that a bonus was applied. The researchers collected 21 distinct second-stage payloads. They used rotating XOR keys and randomized variable names and were functionally unchanged, so only the obfuscation varied.

Why takedowns did not end it

Each stage lives on a service the operators do not own, so removing one document removes one copy of the code. The reported timeline shows how little that cost them.

How do I protect against browser-based ClickFix attacks?

Restrict who can install browser extensions by role, audit the extensions already deployed, and watch browser sessions for requests to Google Docs that no other Google Docs activity explains. The researchers' own advice, as reported, is the same: manage browsers, limit extension installs such as Tampermonkey by role, and monitor for requests to Google Docs from unexpected sessions. They said the campaign posed no specific threat to most organizations, but the techniques did.

Staff need one rule as well: no real guide, report or support article asks anyone to paste code into the address bar, the developer console or an extension.

What this means for a security team

This section is AegisAI's analysis. The reported targets are people who trade at two swap sites, and the researchers said most organizations face no specific threat from this campaign. The technique is the exposure. A script that rewrites what a page shows and what the clipboard holds works on any web form where a destination is typed or copied, including bank details in a payments portal or an invoice approval page, and a Visualization API request looks the same whatever the script is for.

Three questions settle the exposure: which roles can install browser extensions, whether browser traffic to Google Docs is inspected by session, and whether staff who handle payment destinations verify them through a second channel before sending funds.

Why standard controls miss it

This section is AegisAI's analysis. Controls built on destination reputation have no reason to object to docs.google.com, which most organizations rely on and cannot block outright. Controls built on files have nothing to inspect, because the victim supplies the code. The remaining signal is context: which application or session made the request, and whether anything else in that session touched Google Docs. That is why the reported guidance is about sessions and extensions rather than domains. A lure that arrives by email is still a message asking the recipient to do something on the attacker's behalf, and the request is visible before anything is pasted.

How AegisAI protects against it

AegisAI has not observed this campaign. The reporting lists Telegram, a cybercrime forum and text-sharing sites as channels, and one outlet adds email, so the approach below is how AegisAI treats a lure of this shape when it arrives by email.

AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it. More on how that works: inbound email security.

Aegis does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.

When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.

See a lure like this investigated How inbound protection works

How AegisAI stops credential phishing, 48 seconds

Recommendations for defenders

• Restrict browser extension installation by role with an allowlist, and audit existing deployments for userscript managers such as Tampermonkey.
• Monitor browser sessions for requests to docs.google.com that no other Google Docs activity explains, and investigate them as a possible command channel.
• Limit developer-level browser functions for roles that do not need them, and set the rule in security awareness training that no legitimate guide asks anyone to paste code into the address bar, console or an extension.
• Require a second verification of any payment or deposit destination, through a channel other than the page itself, before funds are sent.
• Where a user reports pasting such a script, treat that browser profile as compromised: review installed extensions and userscripts, and check every payment destination the user entered since.

FAQ