Is share.pluso.ru stealing cookies?

Question

JavaScript

Found suspicious actions after installing the pluso widget
in the head, a couple of scripts are added
kitbit.net/kb.js
t.insigit.com/assets/dct.js
the second reception is obfuscated and mentions cookies.
Are thousands of sites infected?

Answer 1

Yes. On Habré there was more than one article on this topic. They steal cookies, soapboxes, phones, overwrite cookies, etc. In principle, what else to expect when you insert js code from third parties on your domain? It's like letting Tajiks into an apartment to wash the windows, knowing only the phone number of their chief, and go on vacation.

Answer 2

For several years already :)
And there were scandals and investigations.
The owners of the service do not disdain to earn money like this.

Answer 3

I found advice to put instead of pluso, which deals with such dirty tricks, sharing from Yandex. Doesn't he do that?

Answer 4

Wow! And I put them on all my sites!! Well in the console drew attention to a suspicious script.