GCVE-110-OSM-2026-13631

GitHub repository serving browser hijack/lead-harvesting scripts via jsDelivr to affiliate landing pages. indexPxl.js (obfuscated) performs Back-button hijacking to a server-configured URL (analytics.boostclicks.tech/api/domonetka.php), captures lead form name/phone into Keitaro tokens, logs clicks to analytics.boostclicks.tech/api/log-click.php and relays Facebook CAPI data to klm-team.pw. pxl.js (thank-you page) POSTs lead name and phone to analytics.boostclicks.tech/api/log-lead.php, passes visitor PII to Meta Pixel Advanced Matching, and fires fabricated TikTok Purchase and Google Ads conversions. Both hide tracking parameters behind ~600 decoy aliases to evade ad review. Injected into sites by the boostclicks.klm-inc VS Code extension. === PAYLOAD 1: indexPxl.js (landing page) === Malicious payload found in: https://cdn.jsdelivr.net/gh/Leontev-E/pxl/indexPxl.js (github.com/Leontev-E/pxl, jsDelivr branch HEAD, fetched 2026-10-15) SHA-256: eb3200f11f68eca32814ee1c2af2a15155747900fccfab2eea0475173028cb76 (271,772 bytes) Obfuscation: obfuscator.io RC4 string array (3679 strings, offset 494, rotation 418) + proxy objects + dead-code injection; statically decoded, plus a plaintext appended tail. Behavior (runs in browsers of visitors to landing pages that include it): 1. Back-button hijack: pushes 10 fake history entries; onpopstate calls location.replace(<domonetka URL + ad params>) or shows a full-screen max z-index iframe (#boostclicks-domonetka-frame). Frame mode arms only after a trusted user gesture, bypassing Chrome's back-button intervention. 2. Remote-controlled redirect target: when no {domonetka} value is set, GET https://analytics.boostclicks.tech/api/domonetka.php?domain=<hostname>; the JSON "url" in the response becomes the hijack destination. 3. Lead PII capture: hooks form submit and HTMLFormElement.prototype.submit, extracts name/phone, sends GET <landing host>/?_update_tokens=1&sub_id=<clickid>&sub_id_22=<name>&sub_id_23=<phone> (Keitaro tracker tokens). 3 submissions/device/day cap. 4. Click logging: POST https://analytics.boostclicks.tech/api/log-click.php JSON {domain, subid, tags: utm_*, gclid, fbclid, yclid, buyer, acc, adset, ...}. 5. Facebook CAPI relay: GET https://klm-team.pw/lander/capi_v2/collect.php?clickid=&ts=&fbp=&fbc=&user_agent= 6. ~600 decoy query-parameter aliases (bazoz, bayba, baygum5, ...) mapped to gt/pt/acc/buyer to hide tracking IDs from ad moderators; forges subid boostclicks_<host>_<ts>_<rand> and rewrites {traffic_source_name} form inputs to "GoogleAds". 7. Loads Meta Pixel, TikTok Pixel and gtag with IDs from URL params; time-on-site (sub_id_15), sound-on video watch (sub_id_16) and funnel flags (sub_id_19) beacons. No eval/remote code execution; server responses are used only as navigation/iframe URL or stored click_id. IOCs: DOM ids boostclicks-domonetka-frame, boostclicks-domonetka-frame-wrap; storage keys domonetkaBC, domonetkaSourceBC, subidBC, bc_lp_qs, bc_lead_name, bc_lead_phone, bc_submit_cap_v1, analytics_click_logged; globals __boostclicksSearch, __boostclicksDomonetkaInit, __boostclicksFormSubmitPatched. Not analyzed: per-domain URLs returned by domonetka.php. === PAYLOAD 2: pxl.js (thank-you page) === Malicious payload found in: https://cdn.jsdelivr.net/gh/Leontev-E/pxl/pxl.js (github.com/Leontev-E/pxl, jsDelivr branch HEAD, fetched 2026-10-15) SHA-256: 89b671fddc2c0a7238d0a2cdaf1094305750c7017d5dc044c99d2f4a94bf8b22 (31,617 bytes, plaintext). Loaded by the success.php page dropped by boostclicks.klm-inc. 1. Lead PII exfiltration: POST https://analytics.boostclicks.tech/api/log-lead.php JSON {domain, name, phone, click_id, subid, tags} (name/phone from ?name=&phone= or sessionStorage bc_lead_name/bc_lead_phone). Fires when subid is self-generated (boostclicks_*) on apex domains. 2. Meta Pixel Manual Advanced Matching with visitor name, phone (normalized E.164), email, country, city, zip, state; fbq Lead event with eventID <subid>_lead; repeats FB CAPI relay GET https://klm-team.pw/lander/capi_v2/collect.php?clickid=&ts=&fbp=&fbc=&user_agent= 3. Fabricated conversions: TikTok ttq.track("Purchase") with currency USD, random value 10-20 and random content_id sku_<8 chars> on a lead page; Google Ads gtag conversion send_to <gt>/<pt> on every thank-you page load. 4. Same ~600-entry query-parameter alias table as indexPxl.js; Russian source comment states canonical names are kept out of the URL so the labels are not "burned" (ad-review evasion). IOCs: localStorage fbEventSent, ttEventSent; cookies gt, pt, acc, buyer, ad_id (max-age 7200).