Một nhà phát triển đã tạo tiện ích Chrome Grabber (lưu, sắp xếp link) hoạt động tốt, nhưng tỷ lệ bỏ cuộc của người dùng rất cao trước khi đăng ký: 165 cài đặt, 65 đăng ký, 98 gỡ cài đặt sau 1 tuần. Anh ấy nghi ngờ trải nghiệm onboarding chưa mang lại giá trị tức thì. Bạn có mẹo nào cải thiện không?
#ChromeExtension #ProductDesign #UserOnboarding #Grabber #PhátTriểnSảnPhẩm #TrảiNghiệmNgườiDùng
https://www.reddit.com/r/SideProject/comments/1o1hg3o/built_a_chrome_extension_that_works_but_users/
We got THROWN into a WALL (NOT CLICKBAIT) (NEARLY DIED)
https://spook.tube/videos/watch/a7bc197f-61a6-4c61-9d2f-bffd79bec8a1

So, someone I know has fallen victim to a discord grabber thingy. Unfortunately, it doesn't just grab the discord token, but also all stored browser passwords - !Including bank details!!
From what I can tell, it seems to be blank grabber, which is no longer under active development but still dangerous.
Me and @max213 have tried reverse engineering the exe (it was compiled with pyinstaller) but to no luck. The malware runs as a background task and reports back to a webhook whenever a new discord login happens so that it can capture the token, so we aim to try retrieve the webhook URL in order to delete it so that the password can be safely reset.
We managed to get the pyc files and partially decompile them using uncompyle, but it seems to use AES or whatever to run the code without antivirus noticing.
If anyone could try and help, that would be amazing.
The extracted .pyc files: https://cdn.discordapp.com/attachments/1143782226648113222/1144919619635781722/Config_for_blank_CC.exe_extracted.zip
Original EXE: https://cdn.discordapp.com/attachments/1143085368833482925/1143102813388427295/Config_for_blank_CC.exe
#malware #reverseengineering #python #pyinstaller #decompile #grabber
A freshly compiled #phoenix #grabber :
https://app.any.run/tasks/a6b95762-a7b5-419c-b808-948a0e32344f#
source:
https://github[.]com/extatent/PhoenixGrabber
cc @da_667 on traffic.