In a novel strategy, cybercriminals are leveraging Google Sheets as a command channel in a campaign aimed at stealing cryptocurrency. Instead of deploying traditional software on a victim’s device, the attackers are converting familiar web browsing sessions into platforms for executing harmful scripts.
Manipulating Code for Cryptocurrency Theft
The perpetrators draw users in with a fictitious report that purports to reveal lucrative vulnerabilities at cryptocurrency swap services. Victims are instructed to insert JavaScript into their browser’s address bar or integrate it into a browser extension, enabling the malicious code to operate on the trading site they access.
This scheme, initially introduced with ClickFix-style tactics in October 2025, incorporated Google’s Visualization API by March 2026. Researchers identified communications on platforms like Telegram, DarkForums, email, and paste sites, targeting individuals with interests in trading, coding, hacking, and rapid financial gain.
The Mechanics of Google Sheets Exploitation
The operation innovatively modifies the traditional ClickFix approach, prompting users to adjust their browser settings rather than instructing them to execute commands via Run or a terminal. Consequently, requests for subsequent attack stages may appear as typical interactions with a trusted Google service.
One of the initial lures suggested a fake API flaw that promised a 38 percent increase in payouts on SwapZone. A subsequent version claimed that a SimpleSwap loyalty feature could yield a 25 percent bonus, directing users to install Tampermonkey and input a loader script.
This approach echoes contemporary ClickFix campaigns, which rely on user actions to initiate malicious activities. The loader retrieves concealed JavaScript from public Google Sheets via the Visualization API, compiles the code, and injects it into active webpages.
Protecting Against Browser-Based Threats
The injected code functions similarly to a web skimmer, monitoring transaction pages, altering visible deposit addresses, intercepting responses containing wallet data, and substituting copied addresses with attacker-controlled alternatives. It also embeds false bonus information to make transactions appear more appealing.
The extension-based variant provides attackers with persistence; each time the target revisits the trading site, the loader can reconstruct and reinsert the malicious payload. Furthermore, the attackers adapt their hosting configurations following takedown efforts, making disruptions short-lived.
The risks extend beyond cryptocurrency exchanges. Compromised extensions, web dependencies, or customer-facing applications could employ comparable browser-side tactics to subtly alter forms or information.
Enhancing Security Measures
Users should view any claim of secret trading bonuses, exploits, or exclusive API access with skepticism. Legitimate websites should never require users to paste code into an address bar or browser extension.
Organizations must regulate browser extensions by role and restrict developer-level browser functions when unnecessary. Security teams are advised to scrutinize unusual Google Docs requests from browser sessions, especially following visits to untrusted forums or links.
Web application owners should audit third-party code and eliminate unexplained, heavily obfuscated JavaScript. The campaign underscores why network trust alone is insufficient to determine web request safety.
Training should prioritize behavioral awareness, not merely blocked domains. Employees and customers need clear guidance on the dangers of copying code from documents, messages, or trading pages, as it can grant attackers control over browser sessions.
