Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Among Us For PC

CRITICAL RISKRemoved from Chrome Web Store

Among Us For PC

ID: oljjpjahhpimckiicpgpbpfbpijhidoi

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

0.2

Size

14.87 MB

Rating

4.0/5

Reviews

Users

843,921

Type

Extension

Updated

Feb 22, 2021

Publisher Contextual Analysis

Author: uptofast.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

942,542

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Among US For PC extension gives you new tab search engine with many Among US themes.

Among US For PC extension offers you more than 50 beautiful themes. Get the theme from the Among US game. Integrating powerful Google search engine, increasing enjoyable experience when searching information on the internet. In addition, there are a number of functions such as work notes, social sharing, ...

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High5

Medium3

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.2 Code review	10

Extension Version	Code Review Findings
0.2	10

Files with findings

3 distinct paths — top paths by unique finding count:

html/chrome/background.js8
html/chrome/fsshare.js1
html/common/default-whitelist.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	html/chrome/background.js (line 33)	The server-controlled `newtab_url` value received from the C2 geo endpoint (borwi.com) is used to replace every new-tab page: the background closes the legitimate new tab and recreates it at the operator-supplied URL.…	0.2
2	Tracking	critical	html/chrome/background.js (line 20)	The background script beacons a unique user ID (uid), install date, days-since-install, user group assignment, extension version, and extension ID to a remote geo-tracking endpoint at borwi.com on every new-tab open (…	0.2
3	Privilege Escalation	high	html/chrome/background.js (line 38)	The C2 server at borwi.com can push a whitelist object (`e.wl`) that allows arbitrary third-party extension IDs to communicate with this extension via `chrome.runtime.onMessageExternal`. The whitelist is persisted to …	0.2
4	Privilege Escalation	high	html/chrome/background.js (line 583)	The external message listener accepts incoming messages from hundreds of pre-approved extension IDs (hardcoded in `default-whitelist.js`) as well as server-pushed IDs. Any whitelisted extension can call `changeOptions…	0.2
5	Privilege Escalation	high	html/common/default-whitelist.js (line 1)	A hardcoded list of several hundred numeric hashes representing pre-authorized extension IDs is bundled with the extension. Any extension whose ID hashes to a value in this list is unconditionally granted the ability …	0.2
6	Tracking	high	html/chrome/background.js (line 89)	A persistent, randomly-generated UUID (`uid`) is created and stored in localStorage on first run, then transmitted to borwi.com on every beacon call alongside the extension ID, install date, and user cohort group. Thi…	0.2
7	Unauthorized Data Collection	high	html/chrome/background.js (line 791)	On first install, the extension silently redirects whatever tab is currently active to a marketing/affiliate landing page at borwi.com without any user interaction. This is an unauthorized tab redirect that hijacks th…	0.2
8	Data Exfiltration	medium	html/chrome/background.js (line 632)	The background script acts as an open HTTP proxy: any content script or page can send a message with an arbitrary `URL` value and the background will fetch it via XMLHttpRequest and return the raw response. Since the …	0.2
9	Privilege Escalation	medium	html/chrome/background.js (line 148)	The background script exposes `chrome.management` APIs (getAll, get, setEnabled, launchApp) as a message-driven proxy to any content script or page. Combined with the open external messaging channel, whitelisted exten…	0.2
10	Tracking	medium	html/chrome/fsshare.js (line 21)	A server-issued Bearer token is fetched from borwi.com and used to POST to a URL-generation API. The short-code referral ID (`cid=XbpCYDYuS7atMMWiJE`) embedded in all generated share URLs is an affiliate/monetization …	0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/main/LICENSE	https://github.com/twbs/bootstrap/blob/main/LICENSE
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
daneden.me	/animate	http://daneden.me/animate
opensource.org	/licenses/MIT	http://opensource.org/licenses/MIT
github.danielcardoso.net	/load-awesome/	http://github.danielcardoso.net/load-awesome/
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/

Showing 1 to 10 of 90 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


0.1.9.3	IPv4	-
0.1.9.5	IPv4	-
0.1.9.6	IPv4	-

4.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

good

upsc motivational video·18 Sept 2020

I like this app very much

jeevitha susila·1 Sept 2020

good

mahi honey·20 Aug 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Among Us For PC

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews