ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Cisco Talos documents a months‑long criminal campaign that lured cryptocurrency traders into pasting JavaScript or installing a Tampermonkey loader which fetched obfuscated second‑stage scripts from publicly published Google Sheets (via the Google Visualization API). The injected web‑skimmer replaced deposit addresses in page content and the clipboard, modified UI elements to fake bonuses, and used rotating attacker wallets; the campaign netted observed payments (~0.159 BTC) and demonstrates a stealthy legitimate‑service abuse C2 technique with potential for wider supply‑chain impact.