The payload grabbed login data on any page that loaded it and rewrote deposit addresses on three trading sites, the security ...