SmartApeSG Supply Chain Attack Targets Okendo

This technical analysis details SmartApeSG's malicious JavaScript loader injected into a third-party Okendo Reviews script: the loader uses localStorage and User-Agent checks to control execution, reconstructs obfuscated next-stage URLs via XOR decoding of split fragments, generates randomized tokens, and dynamically injects script tags to retrieve follow-on content that leads to fake CAPTCHA/social-engineering prompts, PowerShell/HTA downloaders, and deployment of RATs and information stealers.