Ask HN: Unexplained Safari Hack

Recently, we experienced something I've never seen before. It was an attack that seemed almost impossibly well-crafted and targeted, like something from a movie. As of now, I still don't know how it was done and I don't know if the threat is mitigated. Background: For the last 15 years I've developed a web-based scheduling/CRM app that's only used in house by Company X. Access is restricted to a limited number of workstations at a dozen physical offices, as well as a handful of managers' devices. New device tokens need to be authorized by upper management. A few weeks ago, an employee at a location across the country noticed that a customer's name had been changed to a joke based on the real name. They took screenshots. When they reloaded the app, the name returned to normal. The screenshots showed the name changed in one display component but unchanged in others. Since those components draw from the same cached object, it was clear that the hack hadn't affected the cached data or the database. Query logs showed no record of it having been changed in the DB. Furthermore, the name hadn't changed alphabetical position in the customer list, which it would have if the actual data changed. So the edit had to have occurred on that computer, directly on the DOM. It seemed like someone in the office had gone into DevTools and changed the text as a prank. In any event, after investigation, I was satisfied with this explanation. A camera was installed behind the workstation to see if anyone was sneaking up on it. Then a couple days ago, it happened again. Same office, different employee, one workstation over. Nothing unusual on camera. The employee said the screen "went weird" and they saw names change. In this case there were multiple "jokes". One was a reference to a fantasy novel. One was a translation of a customer's name from another language (Romanian) to its English equivalent, which made my hair stand up. Again, the alphabetical order hadn't changed; the text was changed in-situ. But now there were multiple "jokes" on a single name where it translated one way in one component and differently in another at the same time. These components use the same getter function that you'd have to override. I tried to reproduce it by manipulating the dataset directly, and realized it would be almost impossible without deep analysis of our obfuscated frontend code. More easy would be some kind of prank Safari extension... there are extensions that change the DOM on the fly... but you would need to at least write a function to randomize the output to a set of translations from a single Regex match. The employees using this software are nowhere near that sophisticated. No one in the office is likely able to write that code. The manager was in disbelief that any of the employees would even be able to open DevTools. Still, hoping it was the case that we were dealing with a prank extension, I scoured them remotely. They were running Catalina with an outdated version of Safari. The computers had extremely weak passwords. Unfortunately for my best-case scenario, Safari had no extensions installed. MalwareBytes turned up nothing, and I couldn't identify any suspicious processes, although that's always hit-and-miss. The machines were replaced, all passwords changed, extensive log analysis showed no sign of intrusion on the back-end. There was exactly one malformed call around the time from a completely different office, which was unusual, hopefully a coincidence. As of now it seems that this hack only affected those two machines. Still. In order to do this, someone had to see what the browser was displaying and get deeply into the app's structure, or craft some clever Regex and inject it as an extension. All of this just to tweak a few specific customer names. It seems like an absurd amount of effort. I don't know how or why it was done. Has anyone seen something similar?