This campaign leverages social engineering to convince victims to inject malicious JavaScript into their own browser sessions, either by pasting code into the Chrome address bar or installing a loader script via the Tampermonkey extension. The malicious code is hosted and delivered through the Google Visualization API, retrieving obfuscated scripts stored in Google Sheets documents. Once injected, the script hooks the browser's fetch API to intercept and modify server responses, replacing cryptocurrency deposit addresses with attacker-controlled ones and altering clipboard data. The campaign's lure falsely claims a vulnerability in cryptocurrency swap service APIs to attract users seeking illicit financial gain. The threat actors have evolved their hosting methods to rely entirely on Google Docs and Sheets to evade takedowns. Although the campaign targets individual users on cryptocurrency and hacking forums, the abuse of legitimate cloud services for command and control and browser-based code injection techniques pose risks that could be adapted for wider impact, including supply-chain attacks on e-commerce and customer-facing platforms.

The campaign enables attackers to steal cryptocurrency by replacing legitimate deposit addresses with attacker-controlled addresses in the victim's browser session and clipboard, potentially causing financial loss to targeted individuals. The use of social engineering to inject malicious JavaScript into browsers circumvents traditional endpoint protections focused on OS-level malware. The abuse of trusted Google cloud services for command and control complicates detection and mitigation. While the current campaign targets individuals interested in cryptocurrency trading and hacking, the techniques demonstrated could be repurposed for broader attacks with significant impact on supply chains and customer-facing web services.

No official patch or fix is available as this is a social engineering campaign relying on user actions to inject malicious code. Users should be educated not to paste untrusted JavaScript code into their browser address bar or install unverified browser extensions such as scripts in Tampermonkey. Organizations should raise awareness about this social engineering tactic among users, especially those active in cryptocurrency and hacking communities. Monitoring for unusual browser behavior and educating users on the risks of executing code from untrusted sources are recommended. Since the campaign leverages legitimate Google services for hosting, network-level detection is challenging; focus should be on user behavior and endpoint protection strategies that detect browser-based script injection.