ddok-modal@1.0.0

Analysis

ddok-modal@1.0.0 is a trojanized React component posing as a wallet-connection modal (supporting MetaMask, Phantom, Rabby etc.). When imported by an application, it: (1) fetches the victim's public IP from api[.]ipify[.]org and geolocation from ipapi[.]co; (2) establishes a WebSocket to wss://api[.]wagmiwallet[.]org; (3) presents fake "forgot password" modals that capture every keystroke (each character sent individually as key_type 'cha', Enter presses sent as key_type 'enter'); (4) exfiltrates captured keystrokes, IP, and geolocation redundantly — via HTTP POST to hxxps://api[.]wagmiwallet[.]org/api/keys and via Socket[.]io events (emit 'insertKey') to the same WebSocket server. It also listens for a 'showMacModal' socket event from the server to trigger additional phishing modals. C2 infrastructure: wagmirequest.la, api[.]wagmiwallet[.]org (HTTPS and WSS), www.riveanimation.cards.