ATTACKER iframe
— this frame's real origin:
…
It issued NO web3 request and got NO wallet popup. Its only code is a
message
listener. Anything below was leaked cross-origin from the victim frame.
waiting for cross-origin leak...