ClickFix theft moves into the browser

Cisco Talos uncovered a new crypto-skimming operation called ClickFix. It hijacks cryptocurrency deposits straight from a victim’s browser. The campaign rides Google’s Visualization API for command-and-control and a Tampermonkey userscript that rewrites deposit addresses. Anyone who trades on web-based platforms now faces the risk of losing funds.

How ClickFix works

  1. The lure – A victim hunting leaked exploits or software sees a social-engineering prompt advertising a “fix” for the exploit.
  2. Manual injection – The prompt tells the user to copy a snippet of JavaScript into the browser console.
  3. Tampermonkey install – The copied code is saved as a Tampermonkey script, a popular userscript manager that runs custom JavaScript on chosen sites.
  4. Persistence – Tampermonkey stores the script locally, so it stays active even after the browser closes.

The script silently hooks the browser’s fetch API, which handles network requests. When the user initiates a crypto deposit—often through a trading aggregator—the script watches the request, swaps the legitimate destination address for one the attacker controls, and injects fake UI elements like “bonus” offers to keep the victim unaware.

Why the attack matters

  • Direct financial loss – Victims watch their crypto vanish, while the transaction appears to have gone to the intended service.
  • Abuse of legitimate cloud services – By routing C2 traffic through Google’s Visualization API, the campaign blends malicious traffic with ordinary Google traffic, slipping past many network detections.
  • Targeting of aggregators – Most victims use multi-exchange platforms, so a single compromised browser can drain funds across several exchanges.

Hidden details most reports miss

  • No automatic infection – The campaign depends on the victim’s willingness to paste code into the console, limiting spread but exploiting a trust gap among technically inclined users.
  • Tampermonkey’s power – Because Tampermonkey can run scripts on any visited site, one malicious script can affect a wide range of domains without separate payloads.
  • Persistence without root – The script survives browser restarts without needing system-level privileges; removal is as simple as deleting the userscript.

What to watch for next

  • Network monitoring – Flag outbound calls to *.googleusercontent.com or other Google Visualization endpoints from browsers that shouldn’t be making such requests.
  • Extension hygiene – Inventory installed userscript managers and enforce a policy that only approved scripts may run.
  • User education – Teach users that copying code from unknown sources into the console is as dangerous as running a downloaded executable.

Takeaway: Treat any request to paste code into a browser console with the same suspicion you’d give a downloaded program. Tightening extension controls and monitoring Google-hosted traffic are the quickest ways to blunt ClickFix’s browser-side theft.