Fake “API Exploit” Lures Users Into Self-Hacking

Cisco Talos reports a real cryptocurrency-theft campaign where criminals trick people into pasting JavaScript into their browser or installing it via the Tampermonkey extension. The lure pretends to be a leaked vulnerability report for crypto swap sites, but the “exploit” is fake and instead injects a web-skimming script that swaps deposit addresses to steal funds. The attackers also abuse Google Sheets/Docs (via the Google Visualization API) for command-and-control, hiding activity inside normal-looking Google traffic.

Key findings

• Attackers used a ClickFix-style trick to get victims to run attacker-supplied JavaScript in their own browser session (not on the operating system).
• The lure was a fake “leaked vulnerability report” (file name “API Logic Flaw”) promising higher payouts/bonuses on crypto swap services to entice greed.
• Lures were distributed through Telegram, DarkForums, and paste/text-sharing sites; earlier versions also used email.
• Malicious code was staged in publicly published Google Sheets and retrieved via the Google Visualization API for browser-based command-and-control.
• The injected script behaves like a web skimmer: it hooks browser web requests and replaces crypto deposit addresses in both page content and clipboard.

Who’s being targeted

• Commonly targeted roles: All employees (security awareness baseline), Developers/engineers, Finance teams handling payments/crypto, Employees who use browser extensions heavily.
• Affected industries: Cryptocurrency trading and exchange services, Online financial services, Individual consumers (crypto traders).
• Attack channels: website, telegram.
• Impersonated: Independent security researcher / leaked vulnerability report author, Scammer-run Telegram ‘exploit’ channel / “Updated Docs” poster.

Awareness takeaways

• Treat any request to paste code into a browser (or run code to get a ‘bonus’) as a scam and report it.
• Be cautious of ‘leaked security reports’ or ‘updated docs’ shared via Telegram/forums, especially those promising easy money.
• Don’t assume Google-hosted links are safe; attackers can abuse trusted services (Docs/Sheets) to deliver harmful content.
• For crypto-related payments, verify deposit addresses and watch for unexpected address changes or clipboard tampering.

Red flags to watch for

• Instructions to run code directly in the browser address bar using “javascript:”
• Promise of unusually high returns (e.g., higher payouts/bonuses) from a supposed ‘exploit’
• Links routed through public paste sites and Google Docs instead of official vendor channels
• Being instructed to install a browser extension to ‘activate’ a financial bonus
• Script injection/pasting steps coming from Telegram/dark forums rather than the legitimate service
• Claims the victim should limit transactions (behavior-manipulation guidance)