Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: App for Instagram with DM

CRITICAL RISKRemoved from Chrome Web Store

App for Instagram with DM

Name: App for Instagram with DM
Rating: 4.87878787878788 (165 reviews)

ID: ablgadjkhamckdjbbjolcbfjdhhcobmo

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

2.4.0

Size

0.36 MB

Rating

4.9/5

Reviews

165

Users

410,076

Type

Extension

Updated

Jan 24, 2023

Publisher Contextual Analysis

Trusted

Author: http://igapp.meView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

410,076

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Direct Messages is fully supported. Enjoy the most beautiful Desktop client for Instagram.

More and more people all over the world use popular social media platform for communication, entertainment and even business in everyday living. To make this usage more convenient, we gave developed a fully identically mobile version of Instagram website in your browser. It's a good alternative to chat in the web instead of mobile phone while you are working in the office or watch a movie in the evening. Send and receive direct messages, watch stories and review the news feed. All functions are fully available. The world-famous photo | video sharing and editing service, application, and social network is finally available for Chrome Browser! App for Instagram is a Chrome add-on, which tweaks the Desktop Instagram version to look exactly, like a mobile app. Launch the app with an icon click, and enjoy clean, mobile app-style UI, rendered into a separate window. Never miss a photo, video or a story, upload right from your laptop - enjoy all the features of Instagram mobile app on your desktop!

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+0.93%(+3,798 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 168 ratings

Average Rating

Current: 4.90 / 5.0+0.36

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High11

Medium1

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.4.0 Code review	9
2.3.0 Code review	8

Extension Version	Code Review Findings
2.4.0	9
2.3.0	8

Files with findings

5 distinct paths — top paths by unique finding count:

js/background.js12
js/instaLinkListener.js2
js/content.js1
js/setnavigator.js1
js/ua.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/background.js (line 1)	Every 15 minutes the extension beacons to `http://ig-web.net/api/` (unencrypted HTTP) transmitting a persistent unique user ID (`uid`), the extension runtime ID, version, accumulated active-session time (`lt`), and a …	2.3.0
2	Network Interception	critical	js/background.js (line 368)	This monitors successful top-level navigations and asks a remotely configured affiliate/redirect endpoint what to do with each visited domain. The returned URL can trigger further background requests and redirect-chai…	2.4.0
3	Network Interception	critical	js/background.js (line 1)	This handler intercepts ALL requests to `.instagram.com/` at the network level using `webRequest.onBeforeRequest` and cancels them (`{cancel: true}`), routing navigation through an operator-controlled popup window l…	2.3.0
4	Tracking	critical	js/background.js (line 1)	On startup, the extension generates or restores a persistent UUID (`uid`) that uniquely identifies this browser installation and stores it in `chrome.storage.local`. This UUID is then included in every beacon call to …	2.3.0
5	Unauthorized Data Collection	critical	js/instaLinkListener.js (line 1)	This script is injected into ALL URLs across ALL frames (`matches: ['<all_urls>'], all_frames: true`) and installs a MutationObserver that continuously monitors the entire DOM for any anchor tag linking to instagram.c…	2.3.0
6	Code Injection	high	js/background.js (line 79)	This removes `Content-Security-Policy` and frame-busting headers from every main frame and subframe on all sites. That materially weakens site defenses and can enable iframe embedding or script injection that the orig…	2.4.0
7	Code Injection	high	js/ua.js (line 1)	This content script (injected at `document_start` on Instagram pages) dynamically creates a `<script>` element and appends it to the DOM to override `navigator.userAgent` inside the page's JavaScript context using the…	2.3.0
8	Code Injection	high	js/setnavigator.js (line 1)	This script (injected programmatically via `chrome.tabs.executeScript` from the background page into the app's popup tab) uses a double-injection technique: it first calls `Object.defineProperty` on `navigator` in the…	2.3.0
9	Data Exfiltration	high	js/background.js (line 602)	The extension uploads full redirect chains to a remote endpoint as JSON. That exfiltrates a record of the user’s browsing destinations and redirection flow, which can reveal sensitive browsing activity well beyond Ins…	2.4.0
10	Network Interception	high	js/background.js (line 407)	This rewrites outbound request headers on arbitrary HTTP(S) traffic using server-provided configuration, including copying the value of a chosen header into `Accept`. Modifying request semantics at this layer is highl…	2.4.0
11	Network Interception	high	js/background.js (line 452)	This constructs and injects a forged `Referer` header based on prior requests and regex rules from remote configuration. Rewriting `Referer` is a classic technique for affiliate attribution abuse, request spoofing, or…	2.4.0
12	Network Interception	high	js/background.js (line 1)	The extension uses `webRequestBlocking` to intercept and rewrite the `User-Agent` request header on all Instagram HTTP requests, impersonating an Android mobile device. This spoofs the user's identity to Instagram's s…	2.3.0
13	Other	high	js/background.js (line 286)	The extension phones home with a persistent `uid`, extension ID, version, and timestamp, then applies whatever JSON configuration the server returns. That remote config directly controls later behaviors such as reques…	2.4.0
14	Phishing	high	js/background.js (line 314)	Install/update actions are sent to the vendor API together with a persistent UID, and the server response can instruct the extension to open an arbitrary URL in a new tab. That creates a remote-controlled tab-launch p…	2.4.0
15	Remote Code Loading	high	js/instaLinkListener.js (line 39)	This content script injects a remote Mixpanel library from a CDN and initializes it with a server-provided token, while also copying server-supplied values onto `window`. Because `js/instaLinkListener.js` is registere…	2.4.0
16	Unauthorized Data Collection	high	js/background.js (line 182)	This probes `chrome-extension://<id>/manifest.json` and infers whether another extension is installed by checking for `lastError` after `insertCSS`. Combined with the remotely supplied `envCheckList`, it acts as an ex…	2.4.0
17	Tracking	medium	js/content.js (line 1)	The extension injects CSS `<style>` blocks into the Instagram page DOM that load sprite images from `ig-web.net` with a `?v=Date.now()` cache-busting timestamp parameter. This forces a fresh HTTP request to the operat…	2.3.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
igapp.me	/app/img/4c9eeb.png	https://igapp.me/app/img/4c9eeb.png?v
igapp.me	/app/img/4c9eeb-mac.png	https://igapp.me/app/img/4c9eeb-mac.png?v
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.5 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

It's useless. You add it and immediately get told that Chrome is not supported and you have a huge notice blocking you from commenting in DMs.

S Serafin·3 Jan 2023

It works and looks like the mobile app. The only thing that bothers me is that it keeps reporting "This browser is no longer supported", even though I'm using the latest version of Chrome!

Jörg Starkmuth·7 Oct 2022

Easy to use, dependable, useful plug-in. Highly recommended!

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

App for Instagram with DM

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions17

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating