Background

Most ClickFix coverage, including our earlier guide, centres on the Windows Run dialog or a terminal. Cisco Talos has published two investigations, reported by Security MEA (dated 7 October 2026) and in a Cisco press release carried by Zawya, that move parts of the chain into the browser. We opened both secondary sources. We did not open Talos’s own blog posts, because the link targets were not captured in the page text, so check Talos directly for IOCs and the vendor’s detection guidance.

What was reported

Browser-based crypto campaign. Active since October 2025 per Talos. A fake “leaked security report” claims a flaw in two currency swap sites yields a bonus of 25% or more, and spreads via Telegram, criminal forums and text-sharing sites. Victims paste JavaScript into the Chrome address bar, or into a legitimate browser extension so it reloads on every visit. The code fetches its main payload from a public Google Sheet, with the content hidden as white text on a white background. It rewrites deposit addresses on trading pages and copied addresses, and shows a fake bonus. Talos reports 49 Bitcoin addresses, 24 of which received at least about US$10,000, and says the true total is likely higher. After Talos reported it to Google and the affected sites in April 2026 the documents were removed, but a new spreadsheet appeared about a week later and later versions stayed active into August.

Fake Google verification chain. Investigated from April 2026 after activity at a European government organisation. A compromised site (linked to ClearFake) retrieves instructions from a public blockchain, shows a fake Google CAPTCHA, and has the victim paste a command into Windows. The payload is the Amatera infostealer, with follow-on actions that can disable security software, relay attacker traffic and install a hidden copy of commercial remote support software. Talos assesses with moderate confidence that this was part of a broader crypto and credential theft operation.

Talos’s stated defensive emphasis: control browsers and extensions like laptops, and watch which applications request cloud collaboration services, not just whether the destination is trusted.

Telemetry reality check

This is our inference, not from the sources: JavaScript pasted into the address bar runs inside the browser process, so there is no child process or command line to key on. Endpoint rules are weak here. The useful signals are (1) web proxy or secure web gateway logs showing the Sheets fetch and (2) extension inventory. Browsers also legitimately load Google Sheets constantly, so expect noise.

Hunt 1: published Sheet fetched by a non-document workflow (Sigma, proxy)

Untested. The URL shape for published sheets (/spreadsheets/d/e/.../pub) is our assumption from general knowledge of Google Sheets and was not confirmed in the sources we opened.

title: Browser Fetch of Published Google Sheet as Possible Script Payload Store
id: 5d0c1b7e-0a41-4f6e-9b3a-2f7c6e1a9d10
status: experimental
description: Untested. Hunts for requests to published Google Sheets endpoints that may serve script payloads (Cisco Talos browser ClickFix reporting, Oct 2026).
logsource:
  category: proxy
detection:
  selection:
    cs-host: 'docs.google.com'
    c-uri|contains|all:
      - '/spreadsheets/d/e/'
      - '/pub'
  condition: selection
falsepositives:
  - Legitimate published dashboards and data feeds
  - Staff opening shared published sheets
level: low
tags:
  - attack.execution
  - attack.t1059.007

Triage by frequency: a published-sheet URL requested by one or two users once, shortly after a visit to a crypto or swap site, is far more interesting than one requested hundreds of times a day.

Hunt 2: rare Sheets access from browsers (KQL, Defender XDR)

Untested. RemoteUrl in DeviceNetworkEvents is often host-only, so this finds rarity by device, not the exact sheet.

DeviceNetworkEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","brave.exe","firefox.exe")
| where RemoteUrl =~ "docs.google.com"
| summarize Hits = count(), Days = dcount(bin(Timestamp, 1d)) by DeviceName
| where Hits < 5 and Days == 1
| order by Hits asc

This returns light users, which is not malicious by itself. Pivot to the proxy URL for those devices.

Hunt 3: extension inventory

If you manage Chrome or Edge, export installed extensions and compare against your allowlist. Script-runner and userscript-style extensions that nobody approved matter most, since Talos describes extensions as the persistence option. Enforce an allowlist via browser policy rather than relying on detection.

Gaps and caveats

  • No Talos IOCs are reproduced here; we did not open the primary posts.
  • We found no coverage of how many other families use the same technique. Evidence found as of 2026-10-27 in the two sources above: none on additional actors.
  • None of the rules above were tested against real traffic.