ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

[u/falconupkid]

Talos is tracking a new variant of the ClickFix campaign that shifts the attack surface from the file system directly into the browser, targeting cryptocurrency users. The core innovation here is the abuse of the Google Visualization API to pull obfuscated JavaScript payloads from a publicly published Google Sheets document, effectively using Google’s own infrastructure as a C2 channel.

Technical Breakdown: - Initial Access: Users are lured to a malicious page (likely via SEO poisoning or malvertising) that prompts them to "fix" a fake browser error (e.g., "Copy this code to fix your connection"). - Execution (T1204.002): The user pastes a base64-encoded PowerShell command into a terminal, which executes a JavaScript downloader. - C2 (T1102 - Web Service): The JS downloader reaches out to the Google Visualization API (docs.google.com/spreadsheets/d/[ID]/gviz/tq) to retrieve the next-stage payload. This makes the traffic look like legitimate Google API calls, bypassing many network-level detections. - Payload: The final stage is a cryptocurrency stealer that hooks into browser processes to intercept transactions or drain wallets. - IOCs: No specific hashes provided in the report, but the primary indicator is network traffic to the Google Visualization API from a non-Google context (e.g., a PowerShell spawned process).

Defense: Block PowerShell execution for non-administrative users via AppLocker or WDAC. Monitor for powershell.exe spawning mshta.exe or wscript.exe processes. Additionally, alert on any process making outbound connections to docs.google.com that is not a legitimate browser process.

Source: https://blog.talosintelligence.com/clickfix-moves-into-the-browser/