[CastleWater20]

Hi, recently there was a scam-post involving getting refunds using a TamperMonkey script on a CryptoRefills site. This post was a scam, and Ill explain how it worked, based upon what I can see.

The poster had a low post count, was relatively new, and had low or no reputation or awards.

The PDF document he shared didnt have any exploit or virus a far as jotti multiengine virus scanner detects.

The PDF detailed how a TamperMonkey script could change your timezone to create a disparity between the CryptoRefills site, and the payment gateway itself. This sounded logical, such a the CryptoRefills site would detect a payment sent, then send a gift card code, while the payment gateway detects a different timezone and thus an expired payment window, refunding your Bitcoin to the origional payment btc address I suppose. This seemed logical, though I was suspiscious that it would be posted for free because if that glitch worked you could make tens of thousands of dollers daily until its patched.

However, since I know Sinisterly often has high-quality leaks, I thought it could be real, some noob leaked an elite method, and it would get patched in a few days.

So I went out and bought Bitcoin enough to do the glitch. By the time I came back, the post was gone, indicating it was a scam.

I decided to look at the TamperMonkey script, suspecting the script could be a crypto-jacker (swaps the payment Bitcoin address with an hacker-controlled btc address) . This turns out to be correct, the TamperMonkey script was heavily obfuscated, indicating it probably was a crypto-jacker script, which would replace the Payment Gateways Bitcoin address, with the hackers bitcoin address, to steal your bitcoin.

The Scammer posted several "proofs" of easily photoshopped/Inspect Element edited pages of people receiving gift card codes via email, adding amazon gift cards to their amazon accounts and getting successfully credited, and such, to add credability. The posts of people who said the method worked, were also made by accounts that had low post count and were new accounts.

The biggest/easiest way to detect that this post was a scam, was the Obfuscated TamperMonkey script, New accounts posting the method and proofs, and lack of any trusted member validating the method.

Just wanted to post this here incase anybody was interested in how that scam works.
If the TamperMonkey script hadn't been obfuscated, I was going to check it for its logic to see how it worked, once I saw it was obfuscated I knew it was a cryptojacker most likely.

Thanks guys, thought that may be interesting for some of you who saw that thread.

That all being said, I'm going to reformat my OS because that PDF may of been infected lol.

[mothered]

Such threads continue to populate this board on a regular basis.

Be sure to use the Report feature.

[FortuneCookie4]

Just wanted to post this here incase anybody was interested in how that scam works.

Yes, and thank you for the explanation. Interesting stuff.

[Fagottino89]

Such threads continue to populate this board on a regular basis.

Be sure to use the Report feature.

I have noticed that, but why the guy that makes the post has the ability to close the thread?

[Atransient120]

You can always tell it’s a scam by the amount of comments from users that were made on the same day it was posted, with their only ever post being “works perfect, defo do it” etc. Just obviously a fake account when you look.

[talrodil]

That all being said, I'm going to reformat my OS because that PDF may of been infected lol.

Thanks for the analysis, this is important info.

I saw the threads popping up repeatedly and it was obviously a scam. I didn't want to investigate further, but makes sense that the browser extension was the attack vector.

I opened the PDF as well, hope it wasn't infected.

[DaturaEnjoyer]

same here. going to reformat OS

[0piates]

I'm not gonna lie to y'all, it's my first day on here and I fell for that shit. LUCKILY, the tampermonkey script didn't fucking work the time I tried it and I ended up just buying an actual gc for Lyft..

I only spent around $70 to try, guess now I got some Lyft money though..

[mothered]

I have noticed that, but why the guy that makes the post has the ability to close the thread?

The thread's closure Is Irrelevant.

It's of the utmost Importance that It's reported asap.

[Fagottino89]

I have noticed that, but why the guy that makes the post has the ability to close the thread?

The thread's closure Is Irrelevant.

It's of the utmost Importance that It's reported asap.

I agree about reporting ASAP but the fact that these people can close the thread it means that we can’t write that is bullsh*t and is spam, and because they only open the thread to write positive comments about it, other people fall for it as it looks legit. I have seen quite a lot of them now and think this little change may help to avoid them as well. I just tag the main moderator as well to involve him/her in the conversation @Oni