Cisco Talos is monitoring a persistent cryptocurrency-stealing operation that utilizes the Google Visualization API for command and control (C2). The attackers employ a "ClickFix" social engineering tactic, deceiving users into manually injecting malicious JavaScript into their browser sessions via the navigation bar or the Tampermonkey extension. The lure targets individuals seeking to exploit non-existent "API logic flaws" on cryptocurrency trading platforms for financial gain.
The injected malicious script functions as a sophisticated web skimmer. It manipulates the browser's Document Object Model (DOM) to replace legitimate deposit addresses with attacker-controlled wallets and hooks the fetch API to intercept transaction data. By hosting obfuscated payloads within public Google Sheets, the actors effectively hide their C2 traffic within legitimate HTTPS requests to trusted domains, complicating traditional network-based detection.
Top comments (0)