Cisco Talos Uncovers New ClickFix Campaigns Using Google APIs and WebDAV Delivery

Cisco Systems Inc.’s Talos Threat Intelligence group has detailed two distinct cybercrime campaigns advancing the "ClickFix" social engineering technique, expanding its reach beyond local command-line manipulation into browser-native skimming and remote WebDAV payload delivery. The developments represent a major tactical shift for ClickFix, an attack methodology first identified in 2024 that deceives targets into manually executing malicious scripts to bypass operating system security warnings and email filters.

According to technical reports released by Cisco Talos researchers Sean Gallagher and Vanja Svajcer, the newly identified operations leverage legitimate web infrastructure—including Google Docs, Google Sheets, Cloudflare Workers, and blockchain smart contracts—to evade detection. While one campaign stealthily skims cryptocurrency transactions directly within browser sessions, the other deploys multi-stage malware that disables endpoint protections and installs persistent remote access tools.

In the first campaign detailed by Cisco Talos, threat actors bypass operating system command prompts entirely. Instead of urging victims to run PowerShell code or open terminal applications, the attack relies on deceptive lures—framed as leaked vulnerability reports describing nonexistent API flaws—distributed across Telegram channels, cybercrime forums such as DarkForums, and text-sharing sites like Pastebin.

Targets are instructed to copy malicious JavaScript directly into the Chrome address bar or install it into the Tampermonkey browser extension to exploit a fictitious validation gap for higher payouts. Once activated, the script functions as an automated web skimmer targeting users of cryptocurrency exchange aggregators SwapZone.io and SimpleSwap.io. The script hooks the browser’s fetch application programming interface (API), dynamically replaces cryptocurrency deposit addresses in server responses and clipboard buffers with attacker-controlled wallets, and renders counterfeit bonus UI elements to mask the diversion.

Command and control (C2) infrastructure for this campaign relies on the Google Visualization API, an unauthenticated, read-only feature dating back to 2008 that allows applications to query public Google Sheets via structured URLs. Threat actors concealed obfuscated JavaScript payloads thousands of rows down in a public spreadsheet, formatting the text as white on a white background. Client browsers fetched these instructions directly from legitimate docs.google.com endpoints during normal web browsing.

Financial tracking by Cisco Talos deobfuscated malware samples active between April and late June 2026, identifying 49 distinct Bitcoin wallet addresses linked to the skimming pipeline. Of these, 24 addresses received funds from victims totaling 0.159 Bitcoin, valued at approximately $10,000 in early August 2026. The stolen funds were subsequently routed through 30 intermediary wallets and processed across more than 3,000 addresses in a complex mixing operation designed to obscure their final destination.

Disruption efforts against the Google-hosted C2 framework have faced persistent resistance from the operators. Although Cisco Talos reported the malicious documents to Google and affected exchange platforms in April 2026, the threat actors re-established infrastructure on fresh Google Sheets and Google Docs within days. As of August 11, 2026, several reported documents remained active despite automated filtering implemented by text-sharing services like paste.sh.

The second campaign detailed by Talos utilizes a delivery mechanism that originates on compromised websites, where malicious Cloudflare Workers inject JavaScript stored on the BNB Smart Chain testnet. This decentralized storage technique, known as EtherHiding, allows operators to alter malicious payloads dynamically without modifying compromised web server files.

On Windows devices, the injected ClearFake script overlays a fake Google CAPTCHA verification window instructing visitors to open the Windows Run dialog, paste a command, and press Enter. The pasted command connects to a WebDAV network path on a randomized subdomain and executes a disguised dynamic-link library (DLL) file through the native rundll32.exe utility using function ordinals.

Cisco Talos initiated its investigation into this vector after observing a WebDAV DLL execution involving a file named verification.google at a Ukrainian government organization in April 2026. Researchers track the activity cluster as UAT-10820 and assess with moderate confidence that the attacks represent an opportunistic cybercrime campaign rather than a targeted state-sponsored operation.

Both WebDAV loader variants analyzed by Cisco Talos deliver the Amatera information stealer as their primary payload. Once active in memory, Amatera’s collection configuration contains over 400 rules targeting credentials across web browsers, messaging applications including Telegram, Signal, and WhatsApp, password managers such as 1Password, Bitwarden, and KeePass, and more than 100 desktop cryptocurrency wallet locations.

Amatera’s command-and-control server subsequently issues instructions for secondary payloads, which diverge across campaign branches. In the pf.ch loader branch, Amatera deploys a NET NativeAOT library through a signed Google Chrome component (platform_experience_helper.exe), launching ZigCryptoStealer—a clipboard-hijacking payload written in Zig that retrieves its C2 domain from a secondary BNB Smart Chain contract.

To ensure unimpeded execution, ZigCryptoStealer drops a vulnerable signed driver (DCRCVDrv.sys) and abuses its kernel-mode capabilities through input/output control (IOCTL) calls to terminate endpoint detection and response (EDR) software. Concurrently, the same branch installs a Go-based reverse TCP proxy (proxy-panel/cmd/bot) to multiplex outgoing network communications over WebSocket connections.

In contrast, the verification.google branch assigned to UAT-10820 executes PowerShell scripts that conduct environment checks—evaluating system uptime, volume serial numbers, processor counts, and GPU RAM—before generating decoy network traffic to developer portals such as GitHub, PyPI, and Docker Hub. The script then installs a customized, hidden copy of the NetSupport Manager remote access tool.

The NetSupport client configuration disables user interface alerts and regularly polls an HTTP gateway domain resolving to an IP address located in Russia, leading Talos to assess with moderate confidence that a Russian threat actor conducted the verification.google branch. Highlighting the broader enterprise risk, Cisco Talos researchers stated: “While this campaign doesn’t pose a specific threat to most organizations, the approaches that the actors here are using do.”

To mitigate risks from browser-native ClickFix variants and Google API abuse, Cisco Talos recommends that enterprise security administrators enforce strict browser management policies, restricting extension installations by user role. Organizations should also monitor network telemetry for HTTP requests to docs.google.com originating from processes or browser sessions without legitimate Google Docs activity, while conducting regular audits of third-party web dependencies.