Cybercriminals Exploit Google Sheets as Covert C2 in Cryptocurrency Theft Campaign A sophisticated cryptocurrency-stealing operation is leveraging Google Sheets and the Google Visualization API as a command-and-control (C2) channel, delivering malicious JavaScript directly into victims’ browsers. Discovered by Cisco Talos, the campaign represents an evolution of ClickFix social engineering, bypassing traditional malware installation by tricking users into executing code within Chrome. ### How the Attack Works The scheme targets cryptocurrency enthusiasts, developers, and cybersecurity professionals with a fake "API Logic Flaw" vulnerability report, promising inflated returns (e.g., 38% higher payouts on SwapZone or a 25% "loyalty bonus" on SimpleSwap). Victims are lured via Telegram channels, dark web forums, and Pastebin comments to run obfuscated JavaScript either by pasting it into Chrome’s address bar or installing it via the Tampermonkey browser extension. Once executed, the script retrieves malicious payloads from Google Sheets, where attackers hide code in white-on-white text and deep spreadsheet rows to evade detection. The malware then intercepts cryptocurrency transactions, replacing deposit addresses with attacker-controlled wallets. It also employs clipboard hijacking, swapping copied wallet addresses to divert funds even if users manually verify them. ### Technical Sophistication & Evasion Tactics - Google Sheets C2 Abuse: The campaign exploits the Google Visualization API (introduced in 2008) to fetch payloads from public spreadsheets, blending malicious traffic with legitimate Google HTTPS requests. - Browser-Based Persistence: Tampermonkey scripts auto-load on targeted sites, enabling long-term compromise without traditional malware. - UI Manipulation: The malware alters transaction pages, displaying fake "bonus" prompts to mask address swaps. - API Interception: Overrides the browser’s fetch API to modify responses, ensuring victims see attacker-controlled wallets. ### Impact & Financial Losses Cisco Talos identified 49 Bitcoin wallet addresses linked to the campaign, with 24 receiving ~0.159 BTC (~$10,000 at August 2026 valuations). Stolen funds were laundered through 3,000+ addresses, likely via mixing services to obscure trails. ### Broader Implications While targeting individuals, the techniques trusted-service abuse, browser injection, and API manipulation could be adapted for e-commerce, SaaS, or supply-chain attacks. The campaign highlights risks of unmanaged browser extensions and the need to monitor unexpected Google Visualization API traffic (e.g., `docs.google.com/spreadsheets/…/gviz/tq`).