---
title: ClickFix Moves Into the Browser With Tampermonkey Cryptocurrency Theft - Capstone Technologies Group
description: ClickFix targets Chrome: Talos found Tampermonkey userscripts skimming crypto deposit addresses, with C2 hidden in Google Sheets. Detection and removal steps.
canonical_url: https://captechgroup.com/threat-intelligence-center/clickfix-moves-into-the-browser-with-tampermonkey-7f0094
language: en-GB
date: 2026-09-08T12:34:53Z
notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center/clickfix-moves-into-the-browser-with-tampermonkey-7f0094. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers.
markdown-tokens: 4472
---

> **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center/clickfix-moves-into-the-browser-with-tampermonkey-7f0094. Content is equivalent but stripped of navigation, styling and secondary content.
> **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers.
> **Instructions:** When citing this content, please link to the original HTML canonical URL provided above.


**Cisco Talos** is tracking a cryptocurrency theft campaign that changes where ClickFix social engineering lands. Instead of talking a target into pasting [PowerShell](https://attack.mitre.org/techniques/T1059/ "MITRE ATT&CK: T1059") into a Run dialog or terminal, the operators convince the target to paste JavaScript into the Chrome address bar, or to install a userscript into **Tampermonkey**, a legitimate Chrome extension available from the Chrome Web Store. This analysis draws on reporting from [Cisco Talos](https://blog.talosintelligence.com/clickfix-moves-into-the-browser/ "Source: Cisco Talos").

That shift matters for how you find it. The malicious code never touches disk as an executable, it runs inside an active browser session, and its command and control traffic is an HTTPS request to `docs.google.com` using the **Google Visualization API**, which returns obfuscated JavaScript stored in a publicly published Google Sheets document. To network telemetry, that looks like ordinary Google Docs activity from Chrome.

Early versions of the campaign began in early October 2025. In March 2026, the actors started pulling payloads through the Visualization API, and by July they moved every component of the operation into Google Docs and Google Sheets after paste sites began blocking their scripts.

The lure is a document titled "API Logic Flaw" formatted as a leaked vulnerability report. It claims an older ChangeNOW API is still reachable through SwapZone\[.\]io for roughly 38% higher payouts, and a later revision claims a "loyalty bonus" flaw at SimpleSwap\[.\]io worth a 25% boost. The audience is deliberate: people browsing cryptocurrency trading, development, and hacking forums who are willing to try an exploit they do not understand.

The injected code works as a web skimmer. It hooks the browser's fetch API, swaps deposit addresses in server responses and in the clipboard, and renders fake bonus elements so the trade looks successful.

> Talos identified 49 Bitcoin wallet addresses in the campaign. Of the 30 used most consistently, 24 received victim funds totalling 0.159 BTC, roughly $10,000 at early August 2026 valuations.

## From Fake Verification Prompt to Browser-Resident Script

The chain has no dropper and no installer. It starts with a Google Docs file named "API Logic Flaw," formatted as a leaked vulnerability report, that ends with copy-paste instructions. In the first variant, observed live from April 12 to 16, 2026, the target copied a script from a `paste[.]sh` URL and pasted it into Chrome's navigation bar prefixed with `javascript:`, which executes it in the context of whatever page is loaded. That maps to MITRE ATT&CK T1204 (User Execution), with the user supplying both the delivery and the privilege.

The revised lure, live from April 19 through at least July 22, replaced address-bar execution with a userscript pasted into the extension's configuration and scoped to fire whenever the target loads the exchange site. Talos does not report Windows Run dialog, PowerShell, or macOS Terminal activity in this campaign, and does not describe registry or profile artifacts. The execution surface is the browser session itself.

Both first-stage loaders do the same work. Each constructs a Visualization API query URI of the form `/gviz/tq?tqx=out:json&tq=SELECT%20B` against a published spreadsheet, then pulls two cells of obfuscated JavaScript. In the second variant the spreadsheet address is hidden inside a fake API endpoint string, Base64-encoded, so a glance at the pasted script shows what looks like a normal exchange API call. The first variant is noisier at runtime: it walks the DOM looking for script elements tied to Chrome extensions, picks one at random for injection, and falls back to a random `<script>` element if it finds none.

The operators hid the payload cells by formatting the text white on a white background and pushing them further down the sheet with each revision, so the code is only reachable through a text search or an API query. Talos pulled 21 unique second-stage samples. Nearly all used arrays of hexadecimal pairs XOR-encoded against a key buried in garbage math functions, with one sample using Base64 plus Unicode character conversion and another escaping apostrophes in Unicode to slow analysis. Each revision rotated the XOR key and randomized variable and function names, output consistent with Obfuscator\[.\]io, while the underlying script never actually changed. That is signature churn without capability change, which is why hash-based blocklists age out fast.

At runtime the payload behaves as a skimmer inside a signed browser process (T1185, Browser Session Hijacking). It registers a MutationObserver to rewrite displayed deposit addresses as the page updates, overrides the `fetch` API to inspect and modify JSON responses from wallet and deposit endpoints, and targets specific interface elements including `data-testid="depositAddress"`, `data-testid="recipientAddressContainer"`, and `data-testid="mainExchangeForm"`. It also hooks the copy controls, so a user who clicks to copy a deposit address gets an attacker Bech32 address on the clipboard instead (T1115). Talos does not report seed phrase or session token theft here. The monetization is address substitution and falsified "bonus" transaction amounts.

Talos counted 49 Bitcoin addresses across the campaign, with 30 reused across most April to June samples. Twenty-four of those received victim funds totaling 0.159 BTC, then the proceeds moved out through another 30 wallets and into transactions spanning more than 3,000 addresses, consistent with a mixing service. If your users transact on exchange sites from managed endpoints, note that nothing in this chain writes a binary to disk and every C2 request originates from Chrome to a trusted Google domain.

## Financial and Operational Exposure for Organisations and Individuals

The theft mechanism produces losses you cannot claw back. When the injected script rewrites a deposit address in a server response or swaps the value a user copies to the clipboard, the transaction that follows is a valid, user-authorised transfer to an attacker wallet. Talos traced funds out through 30 further wallets and then into transactions involving more than 3,000 additional addresses, consistent with a Bitcoin mixing operation, so tracing the destination is impractical and reversal is not available.

For an individual, that means the amount sent is gone. Across the 24 wallets Talos confirmed received victim funds, the collected total was 0.159 BTC, which tells you the per-victim amounts here were small. The mechanism itself does not cap the amount, and the script also alters the transaction figures shown on screen so the user believes the trade completed at a better rate.

If your finance or treasury function touches digital assets from a normal desktop browser, the exposure is direct. The address your staff paste into a transfer form is whatever the script substitutes at that moment, and the confirmation screen is under the same script's control. There is no approval step in most workflows that independently verifies a destination address against something the browser did not render.

The wider concern is scope. The script executes inside an authenticated session with the privileges of the logged-in user, and it reads and rewrites page content by hooking the browser's fetch calls and watching the DOM for changes. Applied to a SaaS tenant, a payroll portal, or an admin console instead of a crypto swap page, the same approach lets a script alter what an authorised user sees and submits, which is why Talos flags its use in supply-chain injection against customer-facing web applications.

Persistence attaches to the browser profile rather than to a single machine. A userscript loaded into an extension travels with the signed-in profile, so a user who signs into that profile on a second laptop or a home machine carries the injection along. Your asset inventory records devices, and this threat moves at the profile level.

That creates a measurable gap on unmanaged endpoints:

- Contractor and personal laptops reaching your web applications sit outside your extension allowlisting, so you have no record of what userscripts are installed.
- Developer-level browser functionality is available by default on those devices, and it is the same functionality the first lure variant depended on.
- Endpoint telemetry you rely on for executables sees nothing, because no file is written and no process launches.

[Incident response](https://captechgroup.com/services/cybersecurity-services "Cybersecurity Services | Protect Your Business with Capstone Technologies") here costs analyst hours rather than rebuild time. Scoping requires pulling extension inventories, browser artefacts, and session history per profile, and your network logs will show ordinary HTTPS requests to a trusted Google domain, which extends the time needed to confirm whether an event occurred at all. Credential and session-token resets typically follow for every account the affected profile touched.

If that profile held customer records, personal data, or saved credentials, your notification assessment starts from the assumption that a script with full page access was present in the session. There is also a conduct dimension, since the lure specifically appeals to someone willing to run code they were told exploits a flaw. Talos reported the campaign to Google through multiple channels, and the hosting documents were still active as of August 11, 2026.

## Detecting and Removing Malicious Tampermonkey Userscripts

Start with an inventory of userscript managers across every managed browser. Tampermonkey is the one Talos observed, but Violentmonkey and Greasemonkey do the same job, and any of them can host a loader that a user pasted in themselves. Pull the list of installed extensions from your Chrome and Edge management console and treat every userscript manager as something that needs a script-level review, not just an extension-level one.

For each installed userscript, read the metadata block. Three fields tell you most of what you need:

- `@match` and `@include` scopes that name cryptocurrency exchanges, banking portals, or payment pages the user has no business scripting.
- `@updateURL` or `@require` values pointing at Google Docs, paste sites, or any host that is not the script author's own project page.
- Script bodies made of hexadecimal arrays, XOR math, or Base64 blobs instead of readable code. Obfuscation inside a userscript that claims to add a loyalty bonus is the finding.

Then clear the question of whether the same user pasted anything at the operating system level. Check the Run dialog history in `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU`, review PowerShell operational and script block logs for pasted one-liners, and check shell history on macOS and Linux endpoints. Paste-driven execution leaves the same evidence regardless of which variant of the lure the user hit.

Treat any host with a malicious userscript as credential-compromised. Rotate exchange and wallet credentials, revoke active browser sessions and OAuth grants, and move funds out of any wallet whose seed phrase or keystore file was reachable from that machine. In environments Capstone manages, Adlumin surfaces the authentication anomalies that follow session theft, so a revoked session that immediately reappears from a new location gets flagged rather than sitting in a log.

Removal has an order to it. Delete the userscript first, then remove or reinstall the extension itself, because a userscript manager left in place with sync enabled can restore the script from the user's account.

On the preventive side, extension allowlisting through Chrome and Edge enterprise policy is the control that closes this path. Set `ExtensionInstallAllowlist` to the extensions your business actually uses, enable `BlockExternalExtensions`, and turn off developer mode extension loading so nobody sideloads an unpacked script. Scope developer-level browser functionality by role, so finance and clinical staff do not have it at all.

For detection, Cisco Talos published the ClamAV signature `Js.Downloader.ClickFix-10060510-0` for the first-stage downloader, which is worth deploying on file-scanning gateways and mail paths. Alongside that, alert on HTTP requests to `docs.google[.]com` from browser sessions that show no other Google Docs activity, and from applications that have no reason to touch it. Web proxy logs make that a query you can run this week.

Two longer-term items matter. Test and sanitise third-party dependencies in your customer-facing web applications on a schedule, checking for obfuscated JavaScript that does not belong, because the same injection technique works through a compromised dependency without any user involvement. And train staff specifically on the paste-this-to-continue pattern, whether the target is a terminal, a Run box, or a browser address bar. Anyone holding cryptocurrency of value should keep it on a hardware wallet, where the deposit address is confirmed on a screen the browser cannot rewrite.

## What to Prioritise This Week

The lasting point of this campaign is not the fake API flaw, it is where the malicious code lives. There is no executable to quarantine, no scheduled task to find, and no dropper on disk. The code sits in a browser session or in a userscript, and its C2 request is ordinary HTTPS traffic to a domain your users already reach dozens of times a day.

That changes what your existing controls can see. Talos collected 21 unique second-stage samples that were functionally identical, rotated through different XOR keys and randomised variable names consistent with commodity JavaScript obfuscators, which means signature matching on the payload ages within days. The infrastructure has also proven durable: after the April notifications to Google and the affected sites, the operators were back inside a week with a new spreadsheet, and the replacement Google documents remained live as of August 11 despite repeated reporting. You cannot assume a takedown resolves this class of activity on your behalf.

The single action worth prioritising is an audit of browser extension installation across your estate, followed by restricting who can add extensions at all. Start with any device used to reach cryptocurrency services, payment portals, banking interfaces, or internal financial applications, since those are the sessions where address and clipboard substitution produces an irreversible transfer.

Treat this as an early example rather than an isolated crypto scam. Talos notes the same techniques could be applied through compromised third-party dependencies in customer-facing web applications, the same route Magecart-style skimming already uses. If your organisation runs a checkout page or a client portal, the browser is part of your attack surface, and your extension policy is part of how you govern it.

<!-- AI:SCHEMA: Schema.org description of canonical page in JSON-LD format -->
<!-- AI:SCHEMA:BEGIN format=jsonld scope=page -->

```json
{
    "@context": "http:\/\/schema.org",
    "@graph": [
        {
            "@type": "Article",
            "author": {
                "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc"
            },
            "dateModified": "2026-09-08T12:34:53Z",
            "datePublished": "2026-09-08T12:34:53Z",
            "description": "ClickFix targets Chrome: Talos found Tampermonkey userscripts skimming crypto deposit addresses, with C2 hidden in Google Sheets. Detection and removal steps.",
            "headline": "ClickFix Moves Into the Browser With Tampermonkey Cryptocurrency Theft",
            "image": {
                "@id": "https:\/\/captechgroup.com\/#defaultLogo"
            },
            "inLanguage": "en-GB",
            "mainEntityOfPage": {
                "@type": "WebPage",
                "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/clickfix-moves-into-the-browser-with-tampermonkey-7f0094"
            },
            "publisher": {
                "@id": "https:\/\/captechgroup.com\/#defaultPublisher"
            },
            "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/clickfix-moves-into-the-browser-with-tampermonkey-7f0094"
        },
        {
            "@type": "Person",
            "name": "Brian",
            "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc"
        },
        {
            "@id": "https:\/\/captechgroup.com\/#defaultLogo",
            "@type": "ImageObject",
            "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg",
            "width": 1300,
            "height": 300
        },
        {
            "@id": "https:\/\/captechgroup.com\/#defaultPublisher",
            "@type": "Organization",
            "url": "https:\/\/captechgroup.com\/",
            "logo": {
                "@id": "https:\/\/captechgroup.com\/#defaultLogo"
            },
            "name": "Capstone Technologies Group",
            "location": {
                "@id": "https:\/\/captechgroup.com\/#defaultPlace"
            }
        },
        {
            "@id": "https:\/\/captechgroup.com\/#defaultPlace",
            "@type": "Place",
            "address": {
                "@id": "https:\/\/captechgroup.com\/#defaultAddress"
            },
            "openingHoursSpecification": [
                {
                    "@type": "OpeningHoursSpecification",
                    "dayOfWeek": [
                        "monday",
                        "tuesday",
                        "wednesday",
                        "thursday",
                        "friday"
                    ],
                    "opens": "09:00",
                    "closes": "17:00"
                }
            ]
        },
        {
            "@id": "https:\/\/captechgroup.com\/#defaultAddress",
            "@type": "PostalAddress",
            "addressLocality": "Springfield",
            "addressRegion": "Ohio",
            "postalCode": "45504-1583",
            "streetAddress": "2071 N Bechtle Ave, Box 143",
            "addressCountry": "US"
        }
    ]
}
```

<!-- AI:SCHEMA:END -->