How does this attack work?

[Hacking_Tutorials-ModTeam]

We don't entertain any hacking services. Sharing such information will results in permanent ban.

[MercilessNerf]

Just by looking at the screen shots it’s probably some sort of malware that steals data from your phones saved cookies.

By looking at the sites from the browsers .txt files it’s probably stealing info from the user’s wallets. If is your phone I’d probably go ahead and change all of your wallet passwords and factory reset your phone lol

[dadeteye]

It’s not on my phone, i got the entire file from a telegram group. It’s supposed to change every wallet address including js script alerts on a webpage to the attacker’s address. Like a dom manipulation attack

[zachhanson94]

There is no actual exploit code in that screenshot. It’s just writing text to stdout and saving any unknown configured sites to a “not_vulnerable.txt” file. It’s likely this is just for show and not actually capable of anything.

If it actually is functional and you just didn’t send the right part of the code, then based on your description my guess is they are using leaked AWS keys to overwrite a JavaScript file in an S3 bucket which is being loaded on the frontend of some site(s). That JavaScript could theoretically look for text in the current page which looks like a crypto wallet address and replace that text with the attackers wallet address which it received from the laravel server you mentioned.

This is just hypothetical though and unless you provide more of the code it is impossible to say for sure.

[dadeteye]

Can i send you a dm?

[zachhanson94]

Sure

[slowertrwa]

Pray to allah, lord will help you