enter image description here

Recently my secondary e-mail address was exposed by an incident, and soon I received this spam. What is this spam used for?


First of all, HTML parsing of emails you don't trust shouldn't be enabled, let alone javascript. It's a serious security risk! All major email client platforms or webmail platforms have options to disable html and/or javascript on mails.

Now on to the question:

It seems that it is part of the cookieinjector greasemonkey script found here: http://dustint.com/code/cookieinjector.user.js

This script is normally used to capture a value (a cookie copied from a wireshark capture) from the form field and inject it to the page its been running from.

Without further access to the code noone can say exactly what is going on by looking at the picture, but my guess is that it is somehow modified to capture values and send them to the attacker, maybe other cookies etc.

It would be nice if you can provide the raw html source of the email so we can check exactly what is going on.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy