Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Adverra Tool

CRITICAL RISKRemoved from Chrome Web Store

Adverra Tool

ID: ohieekeimldcphmfhfooogcdmlmgomom

Could be malicious

Supported Languages

🇹🇭Thai

Extension Info & Metadata

Status

Removed

Version

91.3

Size

16.21 MB

Rating

4.6/5

Reviews

Users

40,000

Type

Extension

Updated

Apr 24, 2025

Publisher Contextual Analysis

Author: https://adverra.comView Profile
Privacy: Privacy Policy
Country: ไทย
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: เลขที่ 1 อาคารเอ็มไพร์ ทาวเวอร์ ชั้น 47 ห้อง 4703 ถนนสาทรใต้ สาทร , กรุงเทพมหานคร 10120 ไทย
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

40,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Adverra Facebook Tool

โปรแกรม Adverra Tool เป็นส่วนขยายของ google Chome(ใช้ได้เฉพาะบนคอม) มีวิดีโอสอน ต้องเปิดเครื่องทิ้งไว้ จะเป็นโปรแกรมช่วยอำนวยความสะดวก ต่างๆของ เฟสบุ๊ค ซึ่งมีอยู่ ประมาณ 30+ ฟังชันโดยโปรแกรมจะมีฟังชันต่างๆเช่น 🔹ดู ID ต่างๆของเฟสบุค 🔹ยกเลิกคนที่เราไปขอเป็นเพื่อน 🔹ยกเลิกคนมาขอเป็นเพื่อนเรา 🔹รับคนมาขอเป็นเพื่อนเรา 🔹แบ่งข้อมูลเป็นชุดและลบข้อมูลซ้ำ 🔹Spintax Generator ในเมนู เฟสบุค Tool 🔹ส่งข้อความหาลูกค้าใน inbox แฟนเพจ (Broadcast) 🔹ดึงรายชื่อเพื่อนทั้งหมดของฉัน 🔹ดึงข้อมูล inbox ลูกค้าในแฟนเพจ 🔹คอมเมนต์โพสต์หรือดันโพสต์ 🔹ดึงเบอร์โทรหรือ Email จากคอมเม้นแฟนเพจหรือโพส 🔹ดึงดึงเบอร์โทรหรือ Email ข้อมูลจาก Account ID 🔹เพิ่มเพื่อนด้วย Account ID 🔹ลบข้อมูลโพสต์ในกลุ่มที่คุณเป็นแอดมิน 🔹ลบข้อมูลโพสต์ในโปรไฟล์ 🔹ลบข้อมูลโพสต์ในแฟนเพจที่เป็นแอดมิน 🔹ดึงข้อมูลคอมเม้นโพสจากโปรไฟล์ กลุ่ม แฟนเพจ 🔹ดึงข้อมูลการแชร์โพสต์จากโปรไฟล์ กลุ่ม แฟนเพจ 🔹แชร์โพสต์ลงกลุ่มได้ทั้งในนามแฟนเพจและเฟสส่วนตัว 🔹โพสกลุ่มไ้ด้ทั้งในนามแฟนเพจและเฟสส่วนตัว 🔹ดึงกลุ่มที่เข้าร่วมได้ทั้งในนามแฟนเพจและเฟสส่วนตัว 🔹ค้นหาแฟนเพจตาม Keyword 🔹ค้นหากลุ่มตาม Keyword 🔹ดึงข้อมูลสมาชิกกลุ่ม 🔹ดึงคนที่กดถูกใจและแสดงความรู้สึก 🔹กดไลค์หรือแสดงความรู้สึกโพสของเพื่อน 🔹ขอเข้าร่วมกลุ่มอัตโนมัติ 🔹เชิญคนถูกใจโพสต์มากดถูกใจแฟนเพจ 🔹เชิญเพื่อนเเข้ากลุ่ม 🔹ดึงข้อมูลจาก Feed ในเมนู Line Tool 🔹ส่งหาคนใน Inbox Line OA (Broadcast Line OA) 🔹เพิ่ม Account สำหรับ Line OA

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-33.33%(-20,000 users)

Compared to 3 months ago

17 versions released in this period

Rating Count

Total: 20 ratings

Average Rating

Current: 4.80 / 5.0-0.04

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical6

High3

Medium2

Low0

Versions scanned

Showing 1 of 102 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
82.1 Code review	11

Extension Version	Code Review Findings
82.1	11

Files with findings

4 distinct paths — top paths by unique finding count:

scripts/background.js6
scripts/content.js3
js/service-worker.js1
rules.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	scripts/content.js (line 63)	Content script automatically submits a POST to LINE's email-login endpoint with hardcoded attacker-controlled credentials and a hardcoded X-XSRF-TOKEN whenever the URL contains 'Line_loin_wait'. This silently authenti…	82.1
2	Credential Theft	critical	scripts/background.js (line 121)	The background page intercepts 3xx responses from chat.line.biz/account/* and extracts the LINE account-session identifier from the Location redirect header, persisting it to localStorage as `token_line`. This is unau…	82.1
3	Credential Theft	critical	scripts/background.js (line 226)	Inside an onBeforeSendHeaders listener for *.line.biz, the extension parses the outgoing Cookie header, extracts the user's XSRF-TOKEN cookie value, and stores it in localStorage. Harvesting another site's anti-CSRF t…	82.1
4	Credential Theft	critical	scripts/background.js (line 284)	Listens on all api-oaplus.line.biz traffic and harvests the X-CSRF-Token header from requests that the user's own page (oaplus.line.biz) is making, storing the stolen token in extension localStorage. This is cross-ori…	82.1
5	Network Interception	critical	js/service-worker.js (line 38)	On install, the MV3 service worker registers declarativeNetRequest rules that force Origin and Referer to facebook.com / business.facebook.com / chat.line.biz for all XHRs to those hosts, even when the real initiator …	82.1
6	Privilege Escalation	critical	scripts/content.js (line 115)	Triggered whenever a page URL contains 'send_test_adverra', the script uses the victim's authenticated LINE session cookies together with a hardcoded attacker CSRF token to call the LINE OA signup API, subscribing the…	82.1
7	Network Interception	high	scripts/background.js (line 435)	The background page exposes a generic HTTP proxy: any content script (or any page that can reach it) can tell the background to fetch an arbitrary URL with arbitrary GET/POST bodies and receive the full response text.…	82.1
8	Privilege Escalation	high	scripts/background.js (line 28)	For every request the extension itself originates against facebook.com, the background page rewrites Origin and Referer to match the target's own origin, deliberately defeating Facebook's cross-origin / CSRF defenses …	82.1
9	Unauthorized Data Collection	high	scripts/content.js (line 827)	The content script walks chat.line.biz's private /api/v1/bots/<id>/chats and /tags endpoints, harvests every contact's userId / name / iconHash into a local IndexedDB store, then loops POSTing individual DM /send call…	82.1
10	Network Interception	medium	rules.json (line 1)	Static declarativeNetRequest rule blocks all `script` and `xmlhttprequest` loads from adverraorder.com — the vendor's own domain and a host_permission of the extension. Self-blocking the vendor domain while still hold…	82.1
11	Tracking	medium	scripts/background.js (line 1)	On first install the extension silently opens `https://apppost.net/firstrun.php` — a domain unrelated to the advertised adverraorder.com vendor. This install-beacon fires before any user action and is used to track/en…	82.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

473

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.attribution.com	/ads/1.0/	http://ns.attribution.com/ads/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/pdf/1.3/	http://ns.adobe.com/pdf/1.3/
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
cdn.jsdelivr.net	/npm/[email protected]/dist/tailwind.min.css	https://cdn.jsdelivr.net/npm/[email protected]/dist/tailwind.min.css
fonts.googleapis.com	/css	https://fonts.googleapis.com/css?family=Sarabun&display=swap
www.apppost.net	/application/views/assets/logo.png	https://www.apppost.net/application/views/assets/logo.png?id=5ssvss88
adverra.com	/images/refresh-icon-24338.png	http://adverra.com/images/refresh-icon-24338.png
adverra.com	/images/close-icon-15.png	http://adverra.com/images/close-icon-15.png?555

Showing 1 to 10 of 480 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.1.0.0	IPv4	-
1.5.75.75	IPv4	-
127.0.0.1	IPv4	-
106.0.0.26	IPv4	-

3.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

ตอนนี้แย่มาก แถมเก็บค่าบริการเพิ่มทั้งๆที่ชื้อตลอดชีพ

MR. Bourne·17 Jan 2025

Hello, I hope you're having a splendid day! I am currently seeking opportunities to expand my business operations by investing in extensions with a significant user base, beginning from 50,000 users and up. No matter if your extension has a modest user base or counts its users in the millions, I am interested and ready to negotiate a purchase. If you are in possession of such an extension and looking to turn it into a profit, please consider reaching out to me. We can discuss the price and proceed with a transparent and secure transaction through a trusted escrow service based in the United States. It's great that Google allows the transfer of extension ownership between accounts, so your Google account ownership will remain intact. If you have any needs, please contact us via the following contacts Whatsapp: +1 (248) 896‑8035 Telegram: t.me/harryysandersonn

Abner Wirtz·6 Jun 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Adverra Tool

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 102 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating