Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Apollo Tab

CRITICAL RISKRemoved from Chrome Web Store

Apollo Tab

ID: kcnienldjfojomphekhgmpjbemoimhfl

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

2.0.2

Size

6.88 MB

Rating

4.6/5

Reviews

Users

90,000

Type

Extension

Updated

Nov 8, 2021

Publisher Contextual Analysis

Author: http://apollotab.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

90,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Enjoy your clean and neat New Tab that will stimulate your productivity daily. Customize your desktop the way you like it.

Get your Apollo Tab - Your New tab extension!★ Enjoy your clean and neat New Tab that will stimulate your productivity daily and help you focus on your tasks. Apollo Tab extension will provide you with a lot of customizable options such as: - new wallpaper every time you open a new tab to keep your desktop neat and to stimulate your productivity. - full-screen mode as a cool screensaver - weather, location and time widget - there is a small addition - you can customize your desktop. Choose whether you want time widget or not; choose between the wallpapers or shuffle them. - You will have a custom search box and every time you make a search you will be enhanced to a new customized search page ★ We help you create your own browsing experience. Adjust everything the way you like it and become more productive and focused while working. Or just enjoy at the new look of your working space. ★ If you want to uninstall the Apollo tab extension, all you have to do is right-click extension icon in the toolbar and select the option ‘Remove from Chrome’. You won’t have Apollo Tab anymore, sorry about that... You might have a question, feedback or if you want to contact us for any reason, please feel free to do so. You can use links below to find out more about us, and also to find your contact form. Our extension is in a partnership with Adgoal (https://adgoal.de/) and contains their Adgoal script meant for link affiliation. We can receive a reward for a purchase that happens after a user clicks on an affiliate link. You can learn more about the process from Adgoal's privacy policy at https://www.adgoal.de/en/privacy.html. The ads associated with this partnership do not interfere with any third-party website, in-app, or native advertising in any way. Have a nice time browsing with the Apollo Tab ★ HOMEPAGE: https://apollotab.com/ ★ PRIVACY POLICY: https://apollotab.com/privacy-policy.html ★ EULA: https://apollotab.com/eula.html ★ CONTACT FORM: https://apollotab.com/#contact

User Growth

Showing data from Jan 01, 2022 to Jan 09, 2022

Versions

+12.5%(+10,000 users)

Compared to 8 days ago

1 version released in this period

Rating Count

Total: 9 ratings+1 (13%)

Average Rating

Current: 4.56 / 5.0+0.06

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High4

Medium0

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.0.1 Code review	6

Extension Version	Code Review Findings
2.0.1	6

Files with findings

4 distinct paths — top paths by unique finding count:

background.bundle.js3
bg.js1
content.bundle.js1
lib/index.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	background.bundle.js (line 69)	The extension fetches its search-engine hijacking configuration from a third-party domain (mtusconf.de) rather than its own infrastructure. This remote config defines which search engines to target, what link selector…	2.0.1
2	Tracking	critical	background.bundle.js (line 222)	Every matched search result link is replaced with an affiliate redirect URL containing MEMBER_HASH and PANEL_HASH credentials (defined in bg.js as 'DRm5n0Xj' and 'uRyYnoZpUv'). The original destination URL and the use…	2.0.1
3	Tracking	high	background.bundle.js (line 289)	When a user right-clicks a search result and opens it in a new tab, the extension intercepts the newly-created tab via chrome.tabs.onCreated and immediately redirects it to the affiliate URL. This closes the loop on t…	2.0.1
4	Tracking	high	content.bundle.js (line 278)	On every page load the content script sends the full current URL (origin, hostname, pathname) to the background. If the background's remotely-fetched config matches the current site (i.e. a search engine), the backgro…	2.0.1
5	Unauthorized Data Collection	high	bg.js (line 130)	On first install a persistent UUID is generated and immediately POSTed to apollotab.com/ch/install.php. The server returns a 'ch' secret token and utm_uid that are stored locally and attached to every subsequent searc…	2.0.1
6	Unauthorized Data Collection	high	lib/index.js (line 551)	Every search typed into the extension's new-tab search bar is routed through apollotab.com/ch/search.php with the user's persistent UID, browser version, SECRET token, and UTM identifier appended. This allows the oper…	2.0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


mtusconf.de	/universal_search/v2/config/config.json	https://mtusconf.de/universal_search/v2/config/config.json
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	https:///
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
cdnjs.cloudflare.com	/ajax/libs/font-awesome/5.15.3/css/all.min.css	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css

Showing 1 to 10 of 50 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.5 out of 5 · 8 most recent reviews

Text reviews

Positive

Negative

buena

Alian Catalan·5 Jan 2022

nhưng tôi ko biết cài đặt

Vân Phạm Thảo·6 Dec 2021

Love it ��

tinna maslow·3 Dec 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Apollo Tab

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews