Security Alert Do not contact or talk to him.

[380]

What we found after decodingAfter applying the XOR decryption (key = 92), the first readable strings appeared:

•  
  
  Code:

  [color=#c0392b][size=x-large]bc1qn0wcdzggzu0lzx92g6fgae54pdr3wv75r9yszp[/size][/color]
  → This is a Bitcoin wallet address (Bech32)
  
•  
  
  Code:

  [color=#c0392b][size=x-large]appendChild[/size][/color]
  → A JavaScript DOM function (used to add elements into the page)
  
•  
  
  Code:

  [color=#c0392b][size=x-large]hostname[/size][/color]
  → Refers to
  
  Code:

  [color=#c0392b][size=x-large]location.hostname[/size][/color]
  (the website’s host name)
  
• The rest are numeric/technical values related to its operations.
  

---

ConclusionThe script does the following:

1. It contains a hardcoded Bitcoin wallet address (
   
   Code:

   [color=#c0392b][size=x-large]bc1q...[/size][/color]
   ).
   ➝ Meaning: when it manipulates form inputs, it replaces the user’s wallet address with the attacker’s wallet.
   
2. It uses DOM APIs (
   
   Code:

   [color=#c0392b][size=x-large]appendChild[/size][/color]
   ,
   
   Code:

   [color=#c0392b][size=x-large]hostname[/size][/color]
   , …) to add or change elements in the page dynamically.
   
3. It runs periodically (via
   
   Code:

   [color=#c0392b][size=x-large]setInterval[/size][/color]
   ) to reapply the same manipulations continuously.
   

---

⚠️ Final Summary:
This script is a malicious injection for stealing cryptocurrency:

• It monitors crypto input fields.
  
• It swaps the victim’s address with the attacker’s address:
  
  Code:

  [color=#c0392b][size=x-large]bc1qn0wcdzggzu0lzx92g6fgae54pdr3wv75r9yszp[/size][/color]
  .
  
• It injects fake UI elements (e.g., copy buttons) to trick the user into copying the wrong address.
  

---

A malicious script is replacing wallet addresses with the attacker’s:
 

Code:

[color=#c0392b][size=large][font=Comic Sans MS,cursive]bc1qn0wcdzggzu0lzx92g6fgae54pdr3wv75r9yszp[/font][/size][/color]

[380]

..

---

This is a bump