I just got an interesting email in my inbox. This is definitely bad, but let’s see how bad…
Past the AI slop, the attachment is quite sus.
Oh dear.
The uint8 array decodes to https://trk.mail.ru/c/[REDACTED].
Oh dear.
What the payload seems to do is it attempts to load a deliberately nonexistent video file (invalid src), which will then trigger a javascript error causing a redirect to a mail.ru tracking link. The URL eventually points to a scam telegram bot:
I haven’t figured out what the big payload in the body is. It seems to be a random assortment of a-zA-Z0-9. It’s not valid base64. It doesn’t seem to have structure of any kind. Maybe some random chunk of text? Either way it doesn’t seem to actually do anything. The meat and potatoes is in the redirect to the Telegram bot.
After that, it’s no doubt the same MO as the reddit witchcraft scam I wrote about a while ago.