GoKawiilCisco Talos Uncovers Two ClickFix Campaigns Exploiting Google Sheets and Trusted Services
Cisco Talos researchers identified two separate ClickFix-style social engineering campaigns that trick victims into executing malicious code themselves, one aimed at stealing cryptocurrency and another designed to gain persistent enterprise network access. One campaign uses a publicly shared Google Sheet to distribute malicious browser code that hijacks Chrome transaction interfaces, while both operations abuse legitimate cloud services and trusted software to disguise malicious activity as normal user behavior.
GoKawiil's interpretation of the reporting above, not reported fact.
These campaigns show attackers deliberately shifting operations into blast zones like browser sessions, public cloud infrastructure, and signed software where standard network monitoring has limited visibility, making detection harder for enterprise defenders. By turning victims into unwitting participants in their own compromise and leveraging trusted platforms like Google Sheets, attackers can bypass traditional security assumptions about what constitutes suspicious behavior.
- ClickFix attacks are diversifying beyond simple clipboard-paste tricks to abuse legitimate cloud services like Google Sheets.
- One campaign targets cryptocurrency by altering transaction interfaces directly in the browser via malicious code or extensions.
- Attackers are increasingly targeting blind spots such as browser sessions and trusted cloud infrastructure to evade conventional detection.
YubiKey 5 NFC Security Key — Campaigns like ClickFix thrive on tricking people into handing over credentials, and a hardware security key makes stolen passwords far less useful. The YubiKey 5 NFC plugs into USB-A or taps to a phone via NFC for phishing-resistant logins across major accounts and password managers.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Elizabeth Montalbano, 2026-09-08
Published there as: “ClickFix Campaigns Abuse Legitimate Services for Persistent Access”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.