Cisco Talos says a campaign is tricking cryptocurrency users into adding malicious JavaScript to Chrome under the promise of higher trading payouts. The code can replace legitimate deposit addresses with wallets controlled by the attackers.
Earlier instructions told targets to paste a script into Chrome’s address bar. A newer version asks them to install Tampermonkey and add the script there, allowing it to run again whenever the targeted trading site is opened.
This use of Google infrastructure does not mean Google Docs or Chrome are generally compromised. The attackers abused legitimate services after persuading users to install or execute their code.
Who the campaign targets
The lure is a fake vulnerability report aimed mainly at people seeking to exploit cryptocurrency swap services for profit. Talos observed it being promoted through Telegram, DarkForums and text-sharing sites.Earlier instructions told targets to paste a script into Chrome’s address bar. A newer version asks them to install Tampermonkey and add the script there, allowing it to run again whenever the targeted trading site is opened.
What the injected code changes
The malicious script acts as a web skimmer, meaning it secretly changes payment information shown or handled by a website. It can intercept site responses, replace cryptocurrency deposit addresses and display a counterfeit bonus in the page.- Deposit addresses displayed in the trading interface can be changed to attacker-controlled wallets.
- Copied wallet addresses can also be replaced through clipboard hijacking.
- The Tampermonkey version reloads the code when the victim returns to the targeted site.
Google services used to deliver code
Talos found that the loader retrieved obfuscated JavaScript from cells in a publicly published Google Sheets document through the Google Visualization API. Because the requests came from Chrome and went to Google-hosted services, they could resemble normal browser traffic.This use of Google infrastructure does not mean Google Docs or Chrome are generally compromised. The attackers abused legitimate services after persuading users to install or execute their code.
Checks for potentially affected users
- Remove any Tampermonkey script added from an alleged crypto exploit guide, and review other user scripts before leaving the extension enabled.
- Before sending cryptocurrency, compare the destination address with one obtained independently from the intended service; do not rely only on the page or clipboard.
- If you used one of these scripts, review transaction records for unexpected recipient addresses. Talos linked 24 wallets that received about 0.159 BTC, worth roughly $10,000 at early-August 2026 values.
