Cybersecurity researchers have uncovered a new campaign that hijacks cryptocurrency wallet addresses using Google Sheets. Attackers are using fake reports and malicious code injections to convince users to tamper with their browser—through the address bar, console, or a browser extension—and end up sending funds to wallets they don’t control. Screenshots show the group evolving from a basic exploit lure to a more polished scheme using Google’s Visualization API centered on public Sheets.
From ClickFix-style Lures to Sheets-Based Payloads
The scheme began in October 2025, invoking so-called “ClickFix”-style prompts that urged users to execute code manually—for example, pasting scripts into their browser or installing extensions like Tampermonkey. In March 2026, the operation shifted tactics, embracing Google’s Visualization API to host obfuscated JavaScript in cells of public Sheets. These scripts are fetched dynamically, concatenated, and injected back into the victim’s browser whenever they visit key cryptocurrency exchange sites.
The campaign promotes bogus reports claiming large bonuses on crypto swap platforms such as SwapZone and SimpleSwap. In one version, it falsely alleges an unreported exploit at SwapZone offering roughly 38% extra payout; in another, it promises a loyalty bonus at SimpleSwap—then instructs the victim to add a loader script via a browser extension. Once active, the code observes transaction pages, swaps out displayed deposit addresses for attacker-controlled ones, intercepts wallet data in web responses, and even alters clipboard contents.
What Makes This Attack Dangerous & Hard to Block
This form of attack is stealthy. Because the payload comes from Google-hosted Sheets via trusted APIs, it can look like routine traffic. Attackers also added faux bonus information to make the scam seem real and use extensions for persistence—reconstructing the malicious payload any time the user revisits the targeted trading site. Even takedown efforts are often temporary: Sheets and hosting configurations are swapped out as soon as targets or platforms try to block them.
Researchers identified 49 Bitcoin wallet addresses tied to the campaign; 24 of them received a total of about 0.159 BTC—valued near $10,000 as of early August 2026. The actual sums may be larger, as not all addresses or flows have been fully observed.
Defenses and Red Flags to Watch
Users should reject any instruction pushing them to paste code into address bars, developer consoles, or browser extensions in order to unlock features, bonuses, or API access. Always double-check deposit addresses—both the on-screen version and clipboard copy—with a trusted source.
For organizations, limiting extension usage by role and restricting browser developer tools helps reduce risk. Security teams need to look out for unusual access to Google Docs or Sheets from browser sessions that show no other document activity, especially following visits to shady forums or untrusted links.
Web developers and app owners should scrub out obfuscated JavaScript, especially when pulled in via third-party dependencies or Extensions APIs. Because the campaign misuses legitimate services like Google Sheets, network trust should not be treated as proof of safety.
Indicators of compromise include use of Google Docs/Sheets via the Visualization API; paste-site URLs that host loader scripts; domain names like SwapZone.io, SimpleSwap.io as targets; obfuscation services for script output; and suspicious document titles such as “API Logic Flaw.”
This emerging threat shows how easily attackers can exploit trusted platforms like Google Sheets to extend the reach and legitimacy of browser-based scams. It signals an evolution in crypto theft techniques—and a warning that even familiar cloud tools can be weaponized. The bigger picture: trust in online tools and domains is no longer a reliable shield. What to watch next are defenses that focus less on where code comes from and more on how it behaves—and how visibly users are being manipulated or asked to step outside normal security boundaries.
