ClickFix crews shift paste target to Chrome address bar or Tampermonkey

The command channel is a spreadsheet. Since 2008 the Google Visualization API has given free, unauthenticated, read-only access to any Google Sheet published to the web, with the query written into the request URI and the answer returned as JSON or an HTML table ^[13]. Its query language borrows most of its syntax from SQL ^[14]. The feature was eighteen years old by the time this crew adopted it in March 2026 ^[1]. Because the payload is fetched from docs.google.com, there is no attacker-owned domain to sinkhole and no odd certificate to flag ^[4].

Talos points out that hunting Google-hosted C2 normally means looking at DNS traffic together with the process that made the request, the giveaway being a random executable resolving docs.google.com, and that a request issued from inside a browser session is much harder to detect ^[12]. State-sponsored operators have used Sheets, Drive and other Google services this way for years ^[11]. Here the requester is different: it is the browser the user already runs, doing what browsers do.

Blocking userscript extensions in managed Chrome removes the persistence step, because Tampermonkey is the part that survives a session close ^[2]. It does not remove the earlier variant, in which the victim pastes the snippet straight into the navigation bar and nothing is installed at all ^[5][3]. Extension policy closes off that one path and leaves the other open.

The reach is narrow. Two cryptocurrency trading sites, and a victim pool drawn from forums for crypto traders, developers and hackers by advertising an API flaw at swap services that does not exist ^[8][9][3]. That selection matters for reporting as much as for targeting: the people who paste the script believe they are the ones running the exploit. Talos states plainly that the campaign is not a specific threat to most organisations, while flagging the tooling as reusable against e-commerce and other customer-facing systems ^[10].

Roughly nine months separate the first address-bar lures in early October 2025 from July's consolidation of every component into Google Docs and Sheets ^[2]. The pressure that produced that move came from repeated disruption of the operators' posts on shared text sites, not from anything interfering with the injection itself ^[7]. They lost their lure hosting and replaced it with Google's. The skimmer logic did not need to change: it hooks fetch, then rewrites the deposit address and the clipboard ^[4]. Talos names no actor and publishes no victim count or loss figure, so scope beyond the two sites is unmeasured ^[1][8].