Untitled Developer

DEB

Unobfuscate code.

1

This is for cafe/getcoins.js

Obfuscated code.

1

Don't trust that shit. No code should be obfuscated unless it's hiding something. Clear up the damn code.

Everything has been patched

1

yes

Token Stealer

5

Yup it's a stealer. In networking (on a dummy account) it sent the account token.actv to some webhook. It's not a discord webhook but it's a localhostSender webhook.

"Refused to connect to 'https://api.blooket.com/api/users/verify-token' because it violates the following Content Security Policy directive: "connect-src 'self' https://dashboard.blooket.com https://s.blooket.com https://blooket.s3.us-east-2.amazonaws.com https://kit.fontawesome.com https://ka-f.fontawesome.com https://www.googleapis.com https://securetoken.googleapis.com https://identitytoolkit.googleapis.com https://media.blooket.com https://api.cloudinary.com https://images.unsplash.com". getName @ VM97:2...

DE

1

thing