The tactic mirrors a nearly identical exploit on CoinMarketCap two days earlier, where attackers embedded similar code to serve wallet phishing prompts.