Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: AutoIGDM

CRITICAL RISKRemoved from Chrome Web Store

AutoIGDM

ID: cfooaggakokcjkebmpeocmcblejiojoi

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

4.16.3

Size

6.77 MB

Rating

3.5/5

Reviews

Users

4,000

Type

Extension

Updated

Jan 14, 2025

Publisher Contextual Analysis

Author: OmnifusionView Profile
Privacy: Privacy Policy
Help: Help Center
Country: CA
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Address: 2967 Dundas St W #176d Toronto, ON M6P 1Z2 CA

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

4,000

Email Change History

1 change

Aug 9, 2024

Domain changed

Extension for mastering Instagram cold outreach on auto pilot!

🚀 AutoIGDM is not just a tool, it's your personal Instagram assistant working round the clock for you to reach out to valuable leads. 🎯 Target, follow and engage with new prospects effortlessly using profiles, hashtags, post URLs, or your curated list of usernames. Automatically follow them before you reach out or don’t. You decide! Set the stage for endless engagement and let AutoIGDM do it’s magic. 🛠️ Craft multiple automation flows tailored to your brand’s needs. Control the pace with adjustable request numbers per session, and human-like time delays between actions to keep things organic and ban-free. ✉️ Unleash the power of personalized messaging with our dynamic templates. Use the Leads first name as a variable. Mix and match intros, bodies, and outros to keep your messages fresh, personal, and engaging. 🏷️ Organize your contacts with customizable tags, creating a well-structured database that’s as dynamic as your outreach campaigns. Easily find contact and jump to their chat with one click. 🔄 Automated follow-ups, scraping, following, personalizing, messaging and more! AutoIGDM is packed with features to ensure no lead goes unnoticed, and every conversation is a step towards your next big client! Make every interaction count, and watch your Instagram leads coming in on auto pilot! Start today and step into a realm of hassle-free, automated Instagram outreach that translates into real business growth. The only tool you need to get more clients fast! If you're looking for a cloud-based solution that doesn't rely on your computer, your Chrome Browser or any Extension, check out checkout AutoIGDM PRO on the Website http://www.autoigdm.com/pro

User Growth

Showing data from Oct 27, 2023 to Oct 25, 2024

Versions

No change in user count

Compared to 3 months ago

11 versions released in this period

Rating Count

Total: 30 ratings

Average Rating

Current: 4.00 / 5.0+4.00

Item	Type	Severity	Description
scripting	Permission	Critical	This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
debugger	Permission	Critical	This permission grants the extension ability to debug and control other extensions and browser tabs. Rated Critical because it can access and modify other extensions' internal state, inject code, and access sensitive data from any tab.
declarativeNetRequest	Permission	Critical	This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.
cookies	Permission	High	This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact
tabs	Permission	Medium	This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
https://*.instagram.com/	Host	Medium	Host permission — access limited to this URL pattern.
://.office-14.com/	Host	Medium	Host permission — access limited to this URL pattern.
https://*.facebook.com/	Host	Medium	Host permission — access limited to this URL pattern.
Access to Sensitive Domains	Risk Factor	Medium	This extension requests access to sensitive domains: https://.instagram.com/, https://.facebook.com/

Sensitive Domain Access

This extension has access to the following sensitive domains:

https://*.instagram.com/
https://*.facebook.com/

By severity

Critical5

High5

Medium0

Low0

Versions scanned

Showing 1 of 11 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
4.9.5 Code review	10

Extension Version	Code Review Findings
4.9.5	10

Files with findings

3 distinct paths — top paths by unique finding count:

static/background/index.js8
message_through_direct.js1
xhr_headers.c8fd6cde.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	static/background/index.js (line 1055)	When the bot is toggled on, the extension reads ALL cookies for instagram.com using chrome.cookies.getAll and stores them in the shared `u` object (including the CSRF token and session cookies). These values are subse…	4.9.5
2	Credential Theft	critical	static/background/index.js (line 300)	The extension constructs Instagram private API requests with hardcoded internal Instagram app credentials (`x-ig-app-id`, `x-ig-www-claim`) and injects the harvested CSRF token (`x-csrftoken` from `u.csrftoken`). Comb…	4.9.5
3	Data Exfiltration	critical	static/background/index.js (line 149)	All bot activity — Instagram account identifiers, session state, recipient lists, message text, chat IDs, follower data, and API keys — is posted to `https://rocket-leads-api.office-14.com/` (matching the suspicious h…	4.9.5
4	Network Interception	critical	xhr_headers.c8fd6cde.json (line 1)	The extension uses declarativeNetRequest to rewrite Origin, Referer, and sec-fetch-site headers on all third-party requests matching instagram.com. This makes the extension's own outbound requests to Instagram's priva…	4.9.5
5	Remote Code Loading	critical	static/background/index.js (line 127)	The extension polls the remote `office-14.com` server via `get_action` to receive commands that direct what the bot does next (follow users, send messages, stop). This is a classic command-and-control (C2) pattern: th…	4.9.5
6	Privilege Escalation	high	static/background/index.js (line 505)	The extension attaches the Chrome DevTools debugger to Instagram tabs and uses `Input.dispatchKeyEvent` and `Input.dispatchMouseEvent` to programmatically type messages and click UI elements, bypassing normal user int…	4.9.5
7	Tracking	high	static/background/index.js (line 180)	Every bot action — including follow attempts, message sends, errors with stack traces, and toggle events — is logged with the user's CRM nickname and sent to the office-14.com server via `write_log`. This creates a co…	4.9.5
8	Unauthorized Data Collection	high	static/background/index.js (line 879)	On messaging errors, the full innerHTML of Instagram's root DOM element (`[id^="mount_0_0_"]`) is captured and sent to the office-14.com backend via `save_layout`. This DOM dump can contain private message threads, co…	4.9.5
9	Unauthorized Data Collection	high	static/background/index.js (line 697)	The user's Instagram account nickname and API key are sent to the office-14.com backend during account registration and initialization. The `register_account` handler forwards the entire `e.data` payload without filte…	4.9.5
10	Unauthorized Data Collection	high	message_through_direct.js (line 293)	On every messaging fallback, the full DOM (`mount_0_0_` root element innerHTML) of the active Instagram page is captured and passed to the background script. The background script then forwards this to the office-14.c…	4.9.5

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.


fontawesome.comfont	-	https://fontawesome.comFont
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/graphs/contributors	https://github.com/twbs/bootstrap/graphs/contributors
github.com	/twbs/bootstrap/blob/main/LICENSE	https://github.com/twbs/bootstrap/blob/main/LICENSE
popper.js.org	-	https://popper.js.org
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML

Showing 1 to 10 of 70 rows

Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.


116.14.21.14	IPv4	-
124.141.22.141	IPv4	-
214.59.11.12	IPv4	-
1.1.2.3	IPv4	-
8.7.5.6	IPv4	-
17.27.59.25	IPv4	-
1.1.1.2	IPv4	-
14.18.1.12	IPv4	-
2.4.2.9	IPv4	-
5.5.1.4	IPv4	-
5.3.8.5	IPv4	-
1.1.3.3	IPv4	-
5.3.8.3	IPv4	-
1.1.3.5	IPv4	-
3.3.3.5	IPv4	-
1.6.3.3	IPv4	-
2.8.1.2	IPv4	-
3.4.4.5	IPv4	-
25.6.3.4	IPv4	-
29.6.7.1	IPv4	-
27.8.8.6	IPv4	-
14.4.4.9	IPv4	-
10.5.2.3	IPv4	-
2.2.2.7	IPv4	-
3.2.5.4	IPv4	-
44.4.3.6	IPv4	-
1.24.15.26	IPv4	-
37.47.55.72	IPv4	-
71.93.251.218	IPv4	-
24.2.45.28	IPv4	-
1.25.15.26	IPv4	-
37.47.54.71	IPv4	-
72.93.248.216	IPv4	-
2.5.7.6	IPv4	-
14.8.3.1	IPv4	-
1.1.3.2	IPv4	-
3.2.1.2	IPv4	-
2.1.3.1	IPv4	-
1.7.4.1	IPv4	-
8.4.6.8	IPv4	-
10.5.1.1	IPv4	-
29.7.5.2	IPv4	-
5.3.9.9	IPv4	-
6.3.9.9	IPv4	-
5.3.9.7	IPv4	-
8.2.4.5	IPv4	-
5.1.2.1	IPv4	-
15.5.4.3	IPv4	-
3.9.1.8	IPv4	-
4.1.1.8	IPv4	-
1.7.57.71	IPv4	-
12.39.26.77	IPv4	-
12.3.3.6	IPv4	-
8.2.37.88	IPv4	-
1.52.47.16	IPv4	-
1.83.38.5	IPv4	-
34.69.49.52	IPv4	-
1.83.79.27	IPv4	-
1.1.1.3	IPv4	-
6.9.201.4	IPv4	-
102.1.6.7	IPv4	-
95.2.1.2	IPv4	-
2.3.3.4	IPv4	-
1.64.47.24	IPv4	-
3.76.47.24	IPv4	-
1.65.47.23	IPv4	-
1.18.71.94	IPv4	-
7.53.23.94	IPv4	-

Showing 1 to 68 of 70 rows

Rows per page:

1.5 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

I am extremely disappointed with this tool; it simply does not function as expected. I have encountered ongoing issues, and even when support attempts to assist, the same problems reoccur when I try to use it again. Since my purchase, I have not had the opportunity to utilize it effectively. Consequently, I have decided to cancel my membership. I requested a refund, but my request was denied. As a dissatisfied customer, I feel that this has been a waste of both time and money, and I cannot recommend this product. If a customer is unhappy with a product or service, they should have the right to receive a refund rather than being told no.

GLOBAL MALL TRENDS·21 Mar 2025

Seriously all Youtubers are just being paid to advertise and it's just a scam. Don't waste your money on here please!!!

Maaz Hussaini·10 Mar 2025

Version	Size	Is Malicious	Findings	Permhash
4.16.2 Latest	6.76 MB	Malicious	—	bb97eae87ad83242c27c4d4a7f6d788038378bced3ef5a94d26af429c3bdb6b7
4.16.1	6.76 MB	Malicious	—	bb97eae87ad83242c27c4d4a7f6d788038378bced3ef5a94d26af429c3bdb6b7
4.12.2	6.80 MB	Malicious	—	bb97eae87ad83242c27c4d4a7f6d788038378bced3ef5a94d26af429c3bdb6b7
4.12.1	6.77 MB	Malicious	—	bb97eae87ad83242c27c4d4a7f6d788038378bced3ef5a94d26af429c3bdb6b7
4.9.6	6.12 MB	Malicious	—	bb97eae87ad83242c27c4d4a7f6d788038378bced3ef5a94d26af429c3bdb6b7
4.9.5	6.12 MB	Malicious	10	bb97eae87ad83242c27c4d4a7f6d788038378bced3ef5a94d26af429c3bdb6b7
4.9.4	6.10 MB	Malicious	—	bb97eae87ad83242c27c4d4a7f6d788038378bced3ef5a94d26af429c3bdb6b7
4.9.3	6.10 MB	Malicious	—	bb97eae87ad83242c27c4d4a7f6d788038378bced3ef5a94d26af429c3bdb6b7
4.9.0	6.10 MB	Malicious	—	bb97eae87ad83242c27c4d4a7f6d788038378bced3ef5a94d26af429c3bdb6b7
4.7.2	6.10 MB	Malicious	—	bb97eae87ad83242c27c4d4a7f6d788038378bced3ef5a94d26af429c3bdb6b7

Showing 1 to 10 of 20 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Security Alert: Confirmed Malware

AutoIGDM

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Email Change History

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Sensitive Domain Access

Code Review Findings Summary Across 11 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating