ClickFix Browser Injection Campaign Targets Cryptocurrency Traders

A malicious campaign called ClickFix has shifted its tactics to inject malware into web browsers, targeting cryptocurrency traders. According to Cisco Talos research published in September, the operation began in October 2025 with lures instructing victims to paste JavaScript code into Chrome's navigation bar.

The campaign initially tricked users into running commands on their computers but has now moved to persuade them to inject malicious JavaScript into their browsers. The researchers discovered that the operators used the Google Visualization API to retrieve obfuscated code from a public Google Sheets document and inject it into sessions on two cryptocurrency trading sites.

Talos found that the campaign had survived two disruption attempts, with the operators returning a week after being alerted in April and again despite efforts to shut down the new spreadsheets as of August 11. The researchers collected 21 second-stage payloads from the spreadsheet, rotated with fresh XOR keys and randomized variable names but functionally unchanged.

The injected scripts monitored page changes, replaced displayed deposit addresses, and altered transaction amounts to suggest a bonus had been applied. They also overrode the browser's fetch API, substituting attacker wallet addresses into deposit responses before the data reached the page. Talos identified 49 Bitcoin addresses across the campaign, with most samples drawing on one set of 30, receiving victim funds totaling 0.159 BTC (around $10,000 at early August valuations).

The researchers noted that the real figure was probably higher, and proceeds were routed through 30 further wallets and then more than 3000 addresses in what looked like a mixing operation. Talos advised restricting browser extensions by role and monitoring browser sessions for requests to Google Docs.