| ▲ | strictnein 5 hours ago | |
The code in question is here: https://pastebin.com/raw/mc7psaNF It appears to be normal Adform code plus two appended chunks at the end.
Edit: Activity for those addresses:~$110k bitcoin https://www.blockchain.com/explorer/addresses/btc/bc1qmplgt0... ~$55k in ETH https://www.blockchain.com/explorer/addresses/eth/0xE7983E69... | ||
| ▲ | VoidWhisperer 9 minutes ago | parent | next [-] | |
The bitcoin one has moved the bulk of the funds (minus like $500) to this address: https://www.blockchain.com/explorer/addresses/BTC/bc1qjekyd0... | ||
| ▲ | xkcd-sucks 4 hours ago | parent | prev [-] | |
It's absolutely nuts that there's so much volume of low effort cryptocurrency transfers that replacing clipboard contents with a different wallet address on people not blocking ads on a specific ad network nets anything at all | ||