Blasts & Deals 12.0.26
Credential harvesting and bulk email abuse
“Two opt-in tools in one extension: Screen Blasts messaging, and local Savings Sites deals nonprofit fundraiser. Blasts lets you send a cle…”
Browser extension forwards captured login credentials to a hardcoded remote hostExtension install triggers a native host stager
SHA-2564981e64b31dc8f39829a8f24d6e9f9b880f1a20ada3cddb35fde626f68df6db0
Evidence
1"use strict";var duckdb=(()=>{var ql=Object.create;var Fi=Object.defineProperty;var Xl=Object.getOwnPropertyDescriptor;var Ql=Object.getOwnPropertyNames;var Yl=Object.getPrototypeOf,Jl=Object.prototype.hasOwnProperty;var ya=(c,e)=>(e=Symbol[c])?e:Symbol.for("Symbol."+c);var Kl=(c,e,t)=>e in c?Fi(c,e,{enumerable:!0,configurable:!0,writable:!0,value:t}):c[e]=t;var xi=(c=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(c,{get:(e,t)=>(typeof require<"u"?require:e)[t]}):c)(function(c){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+c+'" is not supported')});var pr=(c,e)=>()=>(e||c((e={exports:{}}).exports,e),e.exports),mr=(c,e)=>{for(var t in e)Fi(c,t,{get:e[t],enumerable:!0})},Io=(c,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Ql(e))!Jl.call(c,n)&&n!==t&&Fi(c,n,{get:()=>e[n],enumerable:!(r=Xl(e,n))||r.enumerable});return c};var Bo=(c,e,t)=> …
1:32775… oString(n):"unknown function"])}___assert_fail.sig="vppip";function ___call_sighandler(e,t){return e>>>=0,getWasmTableEntry(e)(t)}___call_sighandler.sig="vpi";var exceptionCaught=[],uncaughtExceptionCount=0;function ___cxa_begin_catch(e){e>>>=0;var t=new ExceptionInfo(e);return t.get_caught()||(t.set_caught(!0),uncaughtExceptionCount--),t.set_rethrown(!1),exceptionCaught.push(t),___cxa_increment_exception_refcount(e),___cxa_get_exception_ptr(e)}___cxa_begin_catch.sig="pp";function ___cxa_current_primary_exception(){if(!exceptionCaught.length)return 0;var e=exceptionCaught[exceptionCaught.length-1];return ___cxa_increment_exception_refcount(e.excPtr),e.excPtr}___cxa_current_primary_exception.sig="p";var exceptionLast=0,___cxa_end_catch=()=>{_setThrew(0,0);var e=exceptionCaught.pop();___cxa_decrement_exception_refcount(e.excPtr),exceptionLast=0};___cxa_end_catch.sig="v";class ExceptionInfo{constructor(t){this.excPtr=t,this.ptr=t-24}set_type(t){HEAPU32[this.ptr+4>>>2>>>0]=t}get_type(){return HEAPU32[this.ptr+4>>>2>>>0]}set_destructor(t){HEAPU32[this.ptr+8>>>2> …
1:2212… async function p(e=!1){if(!await f()){a("Unlock with office password first.","#F59E0B");return}a(e?"Clearing\u2026":"Saving\u2026","#94A3B8");const o=await w("",e?null:q(),{clear:e});if(o?.error==="invalid_office_password"){await c(!1),i(!1),a("Session expired \u2014 enter password again.","#EF4444");return}if(!o?.ok){a(o?.error||"Save failed.","#EF4444");return}s(o?.ad),a(e?"Global footer cleared.":"Saved \u2014 appends to every Blast globally.","#10B981")}function …
527:29… font-size:10px; margin:0 0 3px;">Seed / monitor addresses (one per line)</label>
528 <textarea id="beSeedList" rows="2" placeholder="[email protected] [email protected]"></textarea>
529 </div>
530 <div>
531 <label style="font-size:10px; margin:0 0 3px;">Send t …
5:1525… rray.isArray(o?.[h])?o[h]:[];t.push({...e,ts:Date.now()}),await chrome.storage.local.set({[h]:t.slice(-ae)})}catch{}}async function T(e){try{const o=await ee("/api/email/send-log",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)});if(o&&o.ok)return!0}catch{}return!1}export async function signIn(e){const o=await D();try{if(e==="gmail")return await F({interactive:!0,clientId:o.googleSendClientId,clientSecret:o.googleSendClientSecret})?{ok:!0,email:await A(),error:null}:{ok:!1,email:null,error:"Gmail auth produced no token"};if(e==="microsoft")return await R({interactive:!0,clientId:o.microsoftSendClientId,tenantId:o.microsoftSendTenantId})?{ok:!0,email:await E(),error:null}:{ok:!1,email:null,error:"Microsoft auth produced no token"};if(e==="ses"){const t=await B({decryptFn:b});if(!t)return{ok:!1,email:null,error:"SES not configured or encryption layer locked"};const r=await Q({credentials:t});return r==="unknown"?{ok:!1,email:null,error:"SES credentials rejected by AWS (check key/region)"}:{ok:!0,email:await j(),error:null,sandboxS …
Showing the top 5 files — 6 more files (208 regions) not shown.
No evidence locations were recorded for this file. Raw result