Joomla administrator login skimmer loaded from a fake JavaScript CDN

Script injected into compromised Joomla websites. It keeps its code as two base64 strings, an XOR key and the payload, and runs the decoded code with new Function. The code waits for the site's administrator login form, reads the username and password when the password field loses focus or Enter is pressed, and posts them with the page address to the script's own host, which poses as a JavaScript CDN (reactjscdn[.]com, scripts named after jQuery files under /joomla/).