Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: ClearTax Assistant

CRITICAL RISKRemoved from Chrome Web Store

ClearTax Assistant

ID: lcalogccbhdjlcmkdpipbcmlfgoonagj

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.55

Size

0.39 MB

Rating

5.0/5

Reviews

Users

6,000

Type

Extension

Updated

Mar 22, 2023

Publisher Contextual Analysis

Trusted

Author: http://cleartax.inView Profile
Privacy: Privacy Policy
Help: Help Center
Country: IN
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 23, 24 AMR Tech Park, Block 1, First Floor, AMR Tech Park Internal Rd, Hongasandra Bengaluru, Karnataka 560068 IN
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

6,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

ClearTax Chrome Plugin

All-in-one cloud-based GST toolkit simplifies your GST return filing experience with error-free automated ingestion to smart reporting.

User Growth

Showing data from Mar 24, 2023 to Sep 04, 2023

Versions

+100%(+3,000 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High6

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.55 Code review	9

Extension Version	Code Review Findings
1.55	9

Files with findings

6 distinct paths — top paths by unique finding count:

js/backgroundScript.js3
js/sourceFile.js2
js/fetchCredentials.js1
js/login.js1
js/targetFile.js1
pages/options.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/sourceFile.js (line 678)	The content script running inside gst.cleartax.in listens for messages from the ClearTax application and, upon receiving an API_DATA message, extracts the user's plaintext GSTN portal username and password from the me…	1.55
2	Credential Theft	critical	js/login.js (line 385)	This content script is injected into the Indian government's GST portal login page (https://services.gst.gov.in/services/login*) and automatically fills the username (#username) and password (#user_pass) fields with c…	1.55
3	Code Injection	high	js/backgroundScript.js (line 207)	When the background script receives a message with action 'API_CALL', it uses chrome.scripting.executeScript to dynamically inject fetchCredentials.js into the target tab. This injection is triggered by the ClearTax w…	1.55
4	Code Injection	high	js/fetchCredentials.js (line 1)	This script is dynamically injected by the background service worker and immediately performs a programmatic click on a hidden DOM element with id 'fetchCredentialsFromAPI'. This triggers the ClearTax web app's intern…	1.55
5	Code Injection	high	js/targetFile.js (line 540)	This content script is injected into the Indian government GST payment portal at https://payment.gst.gov.in/payment/auth/ and automatically populates tax payment form fields (CGST, IGST, SGST, CESS amounts) by reading…	1.55
6	Credential Theft	high	pages/options.html (line 404)	The extension's options page exposes a table with columns for GSTIN, Username, and Password, confirming that government GST portal credentials are stored and rendered in plaintext in the extension UI. Any malicious ex…	1.55
7	Data Exfiltration	high	js/sourceFile.js (line 106)	All major content scripts POST detailed behavioral and identity data to https://gst.cleartax.in/funnelmetrics/ including taxable_entity_id (the user's GST entity identifier), billing_account_id, return_period, and gra…	1.55
8	Unauthorized Data Collection	high	js/backgroundScript.js (line 196)	The background script registers an external message listener (onMessageExternal) allowing any page in the externally_connectable list (including cleartax.in environments and localhost) to send arbitrary messages that …	1.55
9	Unauthorized Data Collection	medium	js/backgroundScript.js (line 167)	During tab navigation operations, the background script explicitly deletes the 'AuthToken' cookie for https://return.gst.gov.in/ (the Indian government GST returns portal). This forcibly invalidates the user's authent…	1.55

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


assets1.cleartax-cdn.com	/cleargst/images/feature-checkmark.svg	https://assets1.cleartax-cdn.com/cleargst/images/feature-checkmark.svg
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
gst.cleartax.in	/funnelmetrics/	https://gst.cleartax.in/funnelmetrics/
www.google-analytics.com	/collect	https://www.google-analytics.com/collect
return.gst.gov.in	-	https://return.gst.gov.in/
(	-	https://(?:(?!.gst.gov.in/services/
gstfrontend-stage-http.internal.cleartax.co	/stage-funnelmetrics//	https://gstfrontend-stage-http.internal.cleartax.co/stage-funnelmetrics/\
gst.cleartax.in	/funnelmetrics//	https://gst.cleartax.in/funnelmetrics/\
www.google-analytics.com	/collect/	https://www.google-analytics.com/collect\

Showing 1 to 10 of 80 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


94.87.94.87	IPv4	-

5.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

very good

Manas Singharoy·14 Jul 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

ClearTax Assistant

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating