Hey there, thanks a lot for the answer!
I didn't know blob is for local downloading. That makes this a lot more concerning. The zip we uploaded is coming directly from our unity cloud build setup. I can't see how that would have gotten infected. Here's a link to our webgl zip: https://drive.google.com/open?id=17GRKiDZowuip0tr3vFeIa2TK-6zPY-41
We've took the browser version down because of the security concern.
I can't find anything suspicious in the index.html
I can’t find anything suspicious in the index.html
Unity games run inside of an entire virtual machine with code stored in the binary files that are shipped along with your game, if there’s something malicious in your game then there’s a good chance the code for that is located within that binary file, and not sitting in plain sight in your index.html file.
Also it may simply be some shady ad, if you have integrated some in-game ad SDK
This seems like the most reasonable explanation
