Metro F6 — MotionPoint pref poisoning → attacker script on www.metrobyt-mobile.com

Step 1 runs automatically (writes MotionPoint stored preference; that endpoint has no origin/CSRF check). Then open www.metrobyt-mobile.com (signed in) and wait ~25s.