u/Safe-Lie5394
Hot take but many Girls don't enjoy Resident Evil They just dream of themselves to be fucked by Leon
reddit.comu/Safe-Lie5394 — 6 days ago
▲ 110 r/Gaminggridcommunity
u/Safe-Lie5394 — 28 days ago
Hey everyone, just a massive heads-up if you are trying to buy anything from Cosmic Byte right now. Their website (thecosmicbyte.com) appears to have been compromised, and they are currently hosting a highly sophisticated 'Browser in the Browser' phishing attack designed to steal your Google credentials.
Here is exactly how I stumbled onto it and how the scam works:
How to test it (Please don't actually enter your password):
- I started on the Cosmic Byte home page.
- I clicked the account icon in the top right to log in.
- On the login page, I clicked the "Continue with Google" button.
- Instead of opening a genuine, secure Google pop-up, it generated a fake window inside the webpage itself.
At first glance, it looks identical to a real Google sign-in prompt, complete with a fake address bar showing accounts.google.com and a padlock icon. But a few things gave it away. The title bar of the pop-up was in Russian, then when I clicked the fake "padlock" to check the certificate, the security dropdown that appeared was also entirely in Russian, and I couldn't drag the pop-up outside the bounds of the main browser window.
I tested it by entering a totally fake password (fuckyoulmaodead), and it said wrong password with a bad very poor CSS lol.
I opened up F12 to see what was actually running. The thing was full of warnings showing that the Cosmic Byte website was actively making third-party requests and sending data to a completely different, random domain: itu-ramusgrandst.online/youtube/password/.
I even navigated directly to that URL, and it’s also poorly coded, full-page fake Google login screen.
[ALSO the site loaded very slowly on each page, which was also not normal]
TL;DR: Cosmic Byte has malicious JavaScript injected into their login flow. If you use "Sign in with Google," it creates a fake pop-up that sends your password straight to a scammer's server. Do not log into their site right now, and if you recently did, change your Google password immediately and enable 2FA.
I've already sent an email to their support team with the console logs, but wanted to warn everyone here in the meantime. Stay safe!
u/Elishane0105 — 27 days ago