Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Adspy Master

CRITICAL RISKRemoved from Chrome Web Store

Adspy Master

ID: apdemmelakmialhgmghoipimckjidpia

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.0.0

Size

1.22 MB

Rating

4.4/5

Reviews

Users

9,000

Type

Extension

Updated

Mar 18, 2024

Publisher Contextual Analysis

Author: lukeshaw88457878View Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

9,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Adspy Master is an indispensable tool for exploring advertising information on Facebook

Adspy Master is a powerful browser extension that helps users search for ads across various platforms such as Facebook, TikTok, Instagram, Twitter, and more. With its accurate data filtering capability, users can view running ad posts, filter by age, time, and country. This extension also allows users to search for products currently being advertised in the market using specified keywords. This helps marketers grasp trends and advertising strategies of competitors and industries. Additionally, the extension saves ads displayed on your Facebook news feed. You can review the ads marketed to you. What sets Adspy Master apart is that it's completely free and does not require any fees from users. This not only makes it a valuable tool but also a valuable resource for the global marketing community. The development of this browser extension is non-profit, with the goal of serving and supporting the global marketing community. This is truly a significant step, bringing the features of professional spy tools to everyone without any cost.

User Growth

Showing data from Mar 18, 2024 to Oct 21, 2024

Versions

+50%(+3,000 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 59 ratings+1 (2%)

Average Rating

Current: 4.36 / 5.0+4.36

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical6

High7

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.0 Code review	14

Extension Version	Code Review Findings
1.0.0.0	14

Files with findings

5 distinct paths — top paths by unique finding count:

static/content_scripts/main.js6
service_worker/background.bundle.js4
rules/cors.json2
library/xhr-interceptor.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	service_worker/background.bundle.js (line 57)	The getCK/setCk handlers pass the message payload directly into chrome.cookies.get/set with no validation of name, domain, or url. Combined with externally_connectable for facebook.com and onMessage from <all_urls>, t…	1.0.0.0
2	Network Interception	critical	rules/cors.json (line 46)	This declarativeNetRequest rule strips Facebook's Content-Security-Policy and CSP-Report-Only response headers from every main_frame and XHR response on *.facebook.com. Disabling Facebook's CSP undermines its primary …	1.0.0.0
3	Network Interception	critical	library/xhr-interceptor.js (line 1)	This script monkey-patches XMLHttpRequest.prototype.send and dispatches the entire raw response body and URL of every successful XHR as a DOM CustomEvent. Because the manifest matches <all_urls>, this exfiltrates XHR …	1.0.0.0
4	Network Interception	critical	service_worker/background.bundle.js (line 158)	The updateRule handler accepts an arbitrary list of declarativeNetRequest action/condition objects from a sender (content script or facebook.com page) and installs them as dynamic rules after wiping all existing dynam…	1.0.0.0
5	Privilege Escalation	critical	service_worker/background.bundle.js (line 33)	The background service worker exposes a generic message router accepting actions for arbitrary HTTP fetches, cookie reads/writes, and live updates of declarativeNetRequest dynamic rules — and accepts these via both on…	1.0.0.0
6	Remote Code Loading	critical	static/content_scripts/main.js (line 8113)	The extension fetches an attacker-controlled HTML page (`o`, sourced from extension-tool.onrender.com — see line 8208 / 9264), parses out a `<link as="script">` href, sends it to a remote GraphQL endpoint (`n`, also a…	1.0.0.0
7	Credential Theft	high	static/content_scripts/main.js (line 8150)	A hard-coded fb_dtsg CSRF token from someone else's Facebook session (timestamp suffix 1705458389) is shipped inside the extension and reused for impersonating Lightspeed GraphQL queries against an arbitrary server UR…	1.0.0.0
8	Data Exfiltration	high	service_worker/background.bundle.js (line 78)	The fetch handler performs arbitrary GET/POST to any URL with sender-supplied URL, headers, and body, returning the response body to the caller. Because the extension has host_permissions for http:/// and https://*/…	1.0.0.0
9	Network Interception	high	rules/cors.json (line 2)	The rule forges Origin/Referer/Sec-Fetch-* headers to make outgoing requests to bigspy.com appear as same-origin browser navigations, and forces Access-Control-Allow-Origin: * on responses. This is engineered specific…	1.0.0.0
10	Privilege Escalation	high	manifest.json (line 54)	Combined with the broad message handler in background.bundle.js (fetch/getCK/setCk/updateRule/storage), this allows any script running on facebook.com — including injected ads or scripts enabled by the extension's own…	1.0.0.0
11	Remote Code Loading	high	static/content_scripts/main.js (line 8207)	On a daily cadence the content script reaches out to extension-tool.onrender.com (an attacker-controlled hosting platform commonly used because it does not require domain validation) to download an access token plus t…	1.0.0.0
12	Tracking	high	static/content_scripts/main.js (line 8468)	Listens to the SPY_XHR_INTERCEPTED events fired by the global XHR interceptor and harvests sponsored-ad payloads from the user's Facebook News Feed GraphQL responses, including ad ID, advertiser identity, media URLs, …	1.0.0.0
13	Unauthorized Data Collection	high	static/content_scripts/main.js (line 8605)	The content script reads the Facebook authentication cookie `c_user` (the Facebook user ID) via the privileged getCK message and gates further behavior on it; it also injects xhr-interceptor.js into the page's main wo…	1.0.0.0
14	Network Interception	medium	static/content_scripts/main.js (line 9263)	The extension obtains a bearer token from extension-tool.onrender.com and uses it to call private bigspy.com APIs (ecom/get-ecom-ads, search-by-keyword) — combined with the cors.json rule that forges Origin/Referer to…	1.0.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


.facebook.com	-	https://.facebook.com
bigspy.com	-	https://bigspy.com/
bigspy.com	/*	https://bigspy.com/*
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	https:///
*	/*	http:///

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.0	IPv4	-

3.1 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

not working, just a gimmick

Tamil Iniyan·17 Oct 2024

good idea but dont working :(

Marko Prsic·28 Sept 2024

No se si lo hago mal. Funciono cuando lo instalé y de allí nunca más.

miguel Angel·27 Sept 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Adspy Master

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version14

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews