Decoding gives us another WebSocket based communication channel: wss://cdn[.]iconstaff[.]top/common?source=

Domain iconstaff[.]top was already reported as being Magecart related in June 2024: blog.sucuri.net/2024/06/caes...

Let’s take transaction 0x863f7[…] at Sep-02-2024 02:34:55 PM UTC – we get the following decoded JS:
testnet.bscscan.com/tx/0x863f748...

Another confirmation of the malicious, Magecart related activity, can be found by analyzing other activities from the main BSC testnet contract 0x5178a932d5b312801e02c43fd50399a88028b9d0
testnet.bscscan.com/address/0x51...

This assumption is reinforced when we get a further obfuscated payload from suckerity[.]xyz when visiting the checkout page & subsequently noticing a client to server data exfiltration after having entered credit card details (small extract of the ~200KB deobfuscated code)

The contract’s content is clearly malicious and connects over WebSocket to suckerity[.]xyz (behind Cloudflare), not related to #ClearFake, but reminds us #Magecart related injections:

While investigating an infected website, we noticed call to BSC testnet contract 0x0967296defa0fd586c9ede5730380e2b059fab95 : testnet.bscscan.com/address/0x09...

Nice writeup of Atea's findings regarding this: www.atea.no/siste-nytt/i...

By the way, Google based malvertisement is still going strong – also delivering #Lumma / #LummaStealer currently from hXXps://sites.google[.]com/view/gglchor then chrome.downloading[.]icu

The command it copies in the clipboard has the following string structure:
mshta [URL] # Decoy comment to look genuine to the user and hide the previous commands in the Run prompt

This command starts a long chain of Powershell commands leading finally to #LummaStealer

The infection hides as a base64 encoded & obfuscated Javascript directly on the home page. It gets the overlay from a smart contract and injects it into the HTML.

Another related github repo: github.com/AlexanderRPa... involving domain streammain[.]top hosted on 89.169.13[.]147 . All identified github repos were reported.

Investigating further, we find yet another github repository gavnoman/gootraf which is gone, but seems to have redirected users toward awardbonus[.]shop at 147.45.197[.]80

This domain points toward yet another github account started on July 2nd, 2024 -
github.com/lolngnos/loles . Both domains currently resolve to 77.221.155[.]81 (alias painful-underwear.aeza[.]network (!) hosted at AEZA).

A closer look into bitbucket.org/goo2/adss/sr... reveals domain support-wp[.]shop in the commit log

3. In Javascript files, with a reference to a github repository with a very similar code

2. In JavaScript files, with a reference to a bitbucket repository

1. Directly into the page’s HTML at the top