Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

enter image description here

Recently my secondary e-mail address was exposed by an incident, and soon I received this spam. What is this spam used for?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

First of all, HTML parsing of emails you don't trust shouldn't be enabled, let alone javascript. It's a serious security risk! All major email client platforms or webmail platforms have options to disable html and/or javascript on mails.

Now on to the question:

It seems that it is part of the cookieinjector greasemonkey script found here: http://dustint.com/code/cookieinjector.user.js

This script is normally used to capture a value (a cookie copied from a wireshark capture) from the form field and inject it to the page its been running from.

Without further access to the code noone can say exactly what is going on by looking at the picture, but my guess is that it is somehow modified to capture values and send them to the attacker, maybe other cookies etc.

It would be nice if you can provide the raw html source of the email so we can check exactly what is going on.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.