Tampermonkey

Uh, they've moved since to using a plugin that allows you to inject code into a website.

So the, uh, in this case, it's a plugin called Tampermonkey, which has legitimate uses for many people, but in this case, it's being used essentially as a stepping stone to dropping malicious JavaScript into these trading websites.

And like with other click fix type campaigns, there's a bit of a social engineering thing going on here.

They need to convince the targeted person that they need to drop this code in.

... and marked them as abuse.

So now they've moved to using, uh, using Google Docs to publish the script.

That gets put into a, an, as I said before, a, uh, a Tampermonkey plugin, right? So it's a, it's a script that gets put in a Tampermonkey.

Tampermonkey is a plugin that looks for when you go to a webpage and says, "Okay, this webpage, I have instructions to run this script when this per- when the user visits this scr- page."

This is, like, GPT three days.

I implemented it myself through Tampermonkey in, like, an hour with ChatGPT.

It has still not been done.

It's been, like, a year and a half, maybe two years.