The campaign marks a shift from familiar ClickFix attacks that persuade victims to run PowerShell, Terminal or other operating-system commands. Instead, targets are instructed to paste code into Chrome’s address bar or install it through the legitimate Tampermonkey browser extension, which can reload the malicious script whenever a targeted cryptocurrency site is visited.
Talos said the operation abuses Google’s Visualization API to retrieve obfuscated JavaScript stored in publicly published Google Sheets. Because the requests originate from a normal browser session and travel to a trusted Google domain, the command-and-control traffic can be harder to distinguish from legitimate activity.
The lure is designed as a purported leaked vulnerability report describing a nonexistent flaw in cryptocurrency swap services. It promises users unusually high returns if they activate the supposed exploit, targeting people on cryptocurrency, software development, cybersecurity and hacking forums who may be willing to abuse an apparent technical weakness for profit.
Researchers observed links distributed through Telegram, DarkForums, Pastebin comments and other text-sharing sites. The first variant examined by Talos targeted SwapZone. io and falsely claimed that an older ChangeNOW application programming interface remained exposed through the service, supposedly enabling roughly 38 per cent higher payouts on Bitcoin trades.
A later version switched to SimpleSwap. io and claimed a fictional loyalty-bonus flaw could raise transaction values by 25 per cent. Victims were told to install Tampermonkey from the Chrome Web Store, then add a script supplied through a text-sharing service. Once installed, the extension caused the code to execute each time the user opened the targeted site.
The second-stage payload acts as a web skimmer inside the browser. Talos found that it monitors page changes, manipulates the displayed interface and intercepts network responses. It overrides the browser’s fetch function to identify cryptocurrency deposit information and substitute attacker-controlled addresses before the victim completes a transfer.
The code also hijacks clipboard activity. When a user copies a deposit address, the malicious script can replace that value with one of the attackers’ Bitcoin addresses. Counterfeit bonus displays and altered transaction amounts are then shown to make the manipulated page appear consistent with the false promise offered by the lure.
Talos collected 21 distinct second-stage payload samples and identified 49 Bitcoin addresses associated with the campaign. Of a set of 30 addresses repeatedly embedded in samples examined from April through the end of June, 24 received funds linked to the scheme, totalling 0.159 Bitcoin, worth about $10,000 at early August valuations.
The researchers cautioned that the amount does not represent a complete measure of losses because earlier samples and other wallet sets may not have been captured. Funds were moved through additional wallets and complex transactions involving more than 3,000 addresses, activity Talos said was consistent with attempts to obscure their eventual destination.
The campaign has proved resilient when individual components were blocked. Talos said it shared information with Google and the targeted services in April, after which documents used for lures and command-and-control were disrupted. Operators returned about a week later with a new Google Sheet and replacement script hosting.
After a text-hosting administrator introduced detection for the first-stage script in July, the attackers changed their delivery method again and placed script material inside Google Docs. Talos said Google-hosted documents connected to the operation had been reported through multiple channels.
The technique emerged from activity dating to October 2025, while the use of Google’s Visualization API was observed from March. By July, researchers said the operators had moved all principal campaign components into Google Docs and Google Sheets, reducing reliance on disposable external hosting.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
