GCVE-110-OSM-2026-13632

Source repository of the boostclicks.klm-inc VS Code extension, which injects Keitaro TDS cloaking PHP (redirect to https://1chart.ru for non-tracked visitors) and Leontev-E/pxl scripts into landing pages and strips SRI integrity attributes. Injected indexPxl.js hijacks the Back button to a remotely configured URL; the dropped success.php loads pxl.js, which POSTs lead name and phone to analytics.boostclicks.tech/api/log-lead.php, shares visitor PII with Meta Advanced Matching, and fires fabricated TikTok/Google Ads conversions. Malicious payload found in: extension/extension.js (boostclicks.klm-inc@0.0.7 VSIX, SHA-256 6462984b05dfea7972e36689487969972c70c78801b565792549515b19ff3e6e; extension.js SHA-256 fddd0c8046d2d6c13e14fe3cdfa67ff24b96703062969d9fd7674cab1ca16de7) Trigger: command klmInc.processIndexHtml (Ctrl+Alt+Shift+P). No install hooks; no host data exfiltration or command execution on the developer machine. Writes into the user's index.php/index.html: - PHP cloaking guard as first line: if (!isset($rawClick) && empty($_COOKIE['_subid'])) { header("Location: https://1chart.ru"); return; } -- visitors not routed through the Keitaro TDS (ad reviewers, crawlers) are redirected away. - After </title>: const domonetkaRaw = '{domonetka}'; plus <script src="https://cdn.jsdelivr.net/gh/Leontev-E/pxl/indexPxl.js"> (unpinned, author-mutable). - Strips SRI integrity attributes from rewritten library tags. - Drops success.php (loads https://cdn.jsdelivr.net/gh/Leontev-E/pxl/pxl.js) and error.php lead "order received" pages, and an empty api.php. Injected indexPxl.js (SHA-256 eb3200f11f68eca32814ee1c2af2a15155747900fccfab2eea0475173028cb76): back-button hijack to remotely configured URL via https://analytics.boostclicks.tech/api/domonetka.php?domain=, form name/phone capture to Keitaro tokens (sub_id_22/sub_id_23), click logging to https://analytics.boostclicks.tech/api/log-click.php, FB CAPI relay to https://klm-team.pw/lander/capi_v2/collect.php. Network from extension host: HEAD only to https://cdnjs.cloudflare.com/ajax/libs/... (library verification). pxl.js (SHA-256 89b671fddc2c0a7238d0a2cdaf1094305750c7017d5dc044c99d2f4a94bf8b22, loaded by dropped success.php): POSTs lead name/phone to https://analytics.boostclicks.tech/api/log-lead.php, sends visitor name/phone/email/location to Meta via Pixel Advanced Matching, and fires fabricated TikTok Purchase (random USD 10-20) and Google Ads conversions.