Injected fake loyalty-bonus banner via SwapZone/SimpleSwap loader script

Ankit Mehta@Secvyn

•updated 29 days ago•0•0•0

This rule detects potential browser-based manipulation or phishing campaigns where a user visits a known loader script host (paste.sh) and subsequently visits cryptocurrency trading sites (SimpleSwap, SwapZone) within a short time window. This behavior is indicative of an injected script modifying the browser's view of trading sites to display deceptive 'Loyalty Bonus' or discount banners to lure users into transactions.