PSA:
Just got a weird XSS attack as a 0 sats zap (not sure how that even works).

Seems a good thing I was on Wisp on iOS when it happened, and it didn’t seem to execute. If I was to be on Primal on browser it might have worked.

But may be having to start a new nsec soon anyway.


Here’s what my AI thinks it did:

“This looks like a deliberate XSS (cross-site scripting) attack attempt targeting Nostr clients, likely Primal.

Here's a breakdown of what's happening and what it means:

What the payload is doing

The zap description isn't a normal message. It's an injection attempt containing:

<div> <div> <div> — Nested HTML elements designed to bypass naive sanitizers or exploit rendering quirks in a client that displays zap descriptions as HTML rather than plain text.

A webhook[dot]site URL — Webhook[dot]site is a legitimate tool, but here it's being used as an exfiltration endpoint. Any data sent to that URL goes directly to the attacker. They're using it as a quick, anonymous way to capture stolen data without hosting their own server.

localStorage.getItem('primalSec') — This is the smoking gun. primalSec appears to be a localStorage key used by Primal (a Nostr client) to store sensitive session data. The attacker is trying to steal this credential via XSS and send it to their webhook.

In short: the attacker is sending 0-sat zaps with malicious descriptions hoping your client will render the description as HTML/JavaScript, which would then silently steal your session secrets and beam them to webhook[dot]site.”