ATTACKER iframe — this frame's real origin:
It issued NO web3 request and got NO wallet popup. Its only code is a message listener. Anything below was leaked cross-origin from the victim frame.
waiting for cross-origin leak...