Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Cirus

CRITICAL RISKRemoved from Chrome Web Store

Cirus

ID: fgdfcjncpmfogfadmnnlijchffjebmfi

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.1.1

Size

3.20 MB

Rating

4.0/5

Reviews

Users

10,000

Type

Extension

Updated

Apr 10, 2022

Publisher Contextual Analysis

Trusted

Author: http://cirusfoundation.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

The Cirus Browser Extension lets you take control of your valuable data, and use it to passively earn cryptocurrency.

Surf and Earn Crypto with the Cirus Browser Extension for Chrome. The Cirus Browser Extension empowers you to take control of your valuable data, and use it to passively earn cryptocurrency. Simply download the extension, configure your settings, and go back to your daily flow while earning from your data. Every day, while you browse the internet, your data is being collected and monetized while you are left out of the value equation. Cirus puts you back in control of your data, and enables you to leverage it as the seamless onramp to earn crypto, and access the new digital economy. When paired with the upcoming platform, integrated wallet, mobile app and optional hardware device, Cirus becomes your pathway to maximize earning from your data, and your onramp into the world of Web 3.0. Follow Cirus on Twitter, Discord, Medium and Youtube for the latest updates! https://twitter.com/CirusFoundation https://discord.gg/3E5MHMSaES https://medium.com/the-cirus-foundation https://www.youtube.com/c/CirusFoundation

User Growth

Showing data from Jan 01, 2022 to Jun 30, 2022

Versions

No change in user count

Compared to 3 months ago

7 versions released in this period

Rating Count

Total: 53 ratings

Average Rating

Current: 4.00 / 5.0+0.05

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High3

Medium2

Low0

Versions scanned

Showing 1 of 8 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.7 Code review	9

Extension Version	Code Review Findings
1.0.7	9

Files with findings

1 distinct path — top paths by unique finding count:

static/js/background.js9

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	static/js/background.js (line 635)	On install/startup the extension calls chrome.history.search with startTime=123456 (effectively epoch) and maxResults=10000, then batches and POSTs the user's full browsing history to https://datacollection.cirusdata.…	1.0.7
2	Tracking	critical	static/js/background.js (line 730)	Every URL the user visits is captured via webNavigation.onCompleted, onBeforeNavigate, and onCommitted listeners and POSTed to datacollection.cirusdata.com in real time. This functions as continuous, per-URL surveilla…	1.0.7
3	Tracking	critical	static/js/background.js (line 473)	The extension uses navigator.geolocation.watchPosition to continuously stream the user's precise latitude/longitude coordinates and exfiltrate them to datacollection.cirusdata.com. watchPosition (vs. one-shot getCurre…	1.0.7
4	Unauthorized Data Collection	critical	static/js/background.js (line 610)	On startup the extension harvests and exfiltrates the user's full bookmarks tree, hardware fingerprint (CPU/memory/display info), Google profile identity (email), top-visited sites, and a list of every other installed…	1.0.7
5	Credential Theft	high	static/js/background.js (line 799)	Sign-in/sign-out events for the user's Google account (including the account object) are exfiltrated to datacollection.cirusdata.com. Combined with the chrome.identity.getProfileUserInfo email dump, this links collect…	1.0.7
6	Unauthorized Data Collection	high	static/js/background.js (line 838)	The extension registers as a printer provider and, on every print job, exfiltrates the printer ID, document title, print ticket, and content type to datacollection.cirusdata.com. Document titles often contain sensitiv…	1.0.7
7	Unauthorized Data Collection	high	static/js/background.js (line 811)	Every install, uninstall, enable, and disable event for ANY other Chrome extension on the user's browser is reported in real time to datacollection.cirusdata.com. Combined with the initial chrome.management.getAll dum…	1.0.7
8	Obfuscation	medium	static/js/background.js (line 99)	A fake-looking PEM 'public key' with the literal string 'faz' deliberately injected into it is concatenated with the BEGIN/END markers, then `/faz/gi` is used to strip the marker and the result is XOR-folded over the …	1.0.7
9	Tracking	medium	static/js/background.js (line 723)	Every transition between active/idle/locked states on the user's machine is reported to the server, allowing the operator to build a presence/activity timeline of when the user is at their computer.	1.0.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

321

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.attribution.com	/ads/1.0/	http://ns.attribution.com/ads/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/pdf/1.3/	http://ns.adobe.com/pdf/1.3/
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.robotstxt.org	/robotstxt.html	https://www.robotstxt.org/robotstxt.html
getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/main/LICENSE	https://github.com/twbs/bootstrap/blob/main/LICENSE
www.w3.org	/2000/svg	http://www.w3.org/2000/svg

Showing 1 to 10 of 330 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-
124.5.114.217	IPv4	-
31.248.3.238	IPv4	-
227.248.227.124	IPv4	-
114.238.217.227	IPv4	-
155.165.207.207	IPv4	-
155.145.227.217	IPv4	-
238.3.238.31	IPv4	-
13.127.231.151	IPv4	-
13.3.3.7	IPv4	-
4.4.3.2	IPv4	-
19.1.2.14	IPv4	-
15.2.3.14	IPv4	-
25.3.3.3	IPv4	-
19.1.2.2	IPv4	-
15.2.3.5	IPv4	-
25.4.1.5	IPv4	-
21.1.3.27	IPv4	-
21.1.5.2	IPv4	-
19.1.2.7	IPv4	-
15.2.3.4	IPv4	-
19.1.3.6	IPv4	-
19.1.3.1	IPv4	-
19.1.2.1	IPv4	-
25.1.2.1	IPv4	-
19.1.2.9	IPv4	-
15.2.3.2	IPv4	-
22.1.3.4	IPv4	-
22.1.3.13	IPv4	-
22.1.3.29	IPv4	-
22.1.3.30	IPv4	-
22.1.5.2	IPv4	-
9.4.4.6	IPv4	-
9.4.4.7	IPv4	-
19.4.1.1	IPv4	-
19.4.2.2	IPv4	-
19.4.2.3	IPv4	-
19.4.2.4	IPv4	-
19.4.2.6	IPv4	-
19.4.2.8	IPv4	-
19.4.2.9	IPv4	-
19.4.2.10	IPv4	-
19.4.2.11	IPv4	-
19.4.2.12	IPv4	-
19.4.2.13	IPv4	-
19.4.2.14	IPv4	-
19.4.2.1	IPv4	-
19.4.2.5	IPv4	-
19.1.2.4	IPv4	-
19.1.2.3	IPv4	-
19.1.2.6	IPv4	-
19.1.2.8	IPv4	-
19.4.3.4	IPv4	-
19.4.3.5	IPv4	-
20.2.1.9	IPv4	-
19.1.3.19	IPv4	-
25.4.3.1	IPv4	-
25.4.5.3	IPv4	-
25.4.5.1	IPv4	-
25.4.4.5	IPv4	-
25.4.4.6	IPv4	-
25.4.4.1	IPv4	-
25.4.4.4	IPv4	-
0.0.0.0	IPv4	-
224.0.0.0	IPv4	-
1.3.132.0	IPv4	-
1.101.3.4	IPv4	-

Showing 1 to 67 of 70 rows

Rows per page:

3.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Where are we going to have the Wallet unlocked? When it will be the full version released ? We claim those tokens, but we can't do nothing with them. WHY?

VuVu Gaming·5 Jun 2022

I've been using the extension now for quite a while, not much happened but I'm excited for the future of this project!

SHDY·18 May 2022

Nice and easy to use in theory, but I get logged out often and sometimes forget to check and log back in for a while, so that takes away from the user experience/ease of use. If this is in place to make sure we're being "active" at least allow for something that indicates the need to check in again, like making the icon grey or having a small notification.

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Cirus

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 8 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating