hidalg0d — eToro market-tab postMessage → window.open PoC

Victim window:

The victim must already be logged in to eToro in this browser. Nothing is overlaid and no eToro UI is clicked: the only click is on this page, which opens the victim's own session in a popup.

1. ATTACK <et-research> (type=linkPressed) 1b. ATTACK <et-news> (JSON string, type=linkClicked)

2. CONTROL (type=linkPressedX — must do nothing) 3. CONTROL (plain https:// url — opens a normal tab)