ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

· Blog Talosintelligence · Sept. 8, 2026, 12:51 p.m.
Threat Spotlight Cisco Talos Web Filtering Cybersecurity Cryptocurrency Theft Google Visualization API JavaScript Injection
Summary
Cisco Talos reports on a cryptocurrency theft campaign that exploits the Google Visualization API for command and control, using obfuscated JavaScript from Google Sheets to inject into victims' browsers.
Read full post on blog.talosintelligence.com →
AUTHOR
Advertise
Sponsor diff.blog
Put your product in front of developers who read and write about their craft. One exclusive sponsor at a time.
Become a sponsor →