Recently my secondary e-mail address was exposed by an incident, and soon I received this spam. What is this spam used for?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Now on to the question:
It seems that it is part of the cookieinjector greasemonkey script found here: http://dustint.com/code/cookieinjector.user.js
This script is normally used to capture a value (a cookie copied from a wireshark capture) from the form field and inject it to the page its been running from.
Without further access to the code noone can say exactly what is going on by looking at the picture, but my guess is that it is somehow modified to capture values and send them to the attacker, maybe other cookies etc.
It would be nice if you can provide the raw html source of the email so we can check exactly what is going on.