Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: ContentDownloadMaster

CRITICAL RISKRemoved from Chrome Web Store

ContentDownloadMaster

ID: bdidaacagfelkdahkmlobdicghmamchc

Could be malicious

Supported Languages

🇺🇸English

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

1.0.2

Size

0.24 MB

Rating

5.0/5

Reviews

Users

9,000

Type

Extension

Updated

Feb 10, 2022

Publisher Contextual Analysis

Author: alexanderdagrinView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

9,005

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

ContentDownloadMaster extension is here to help you download media files from different websites. It is fast and simple! Just…

ContentDownloadMaster extension is here to help you download media files from different websites. It is fast and simple! Just click the download button at the popup menu and wait for a few seconds until your chosen video or videos are saved to your device.

User Growth

Showing data from Jan 01, 2022 to Feb 19, 2022

Versions

+40809.09%(+8,978 users)

Compared to 2 months ago

3 versions released in this period

Rating Count

Total: 24 ratings

Average Rating

Current: 5.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High3

Medium3

Low0

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0 Code review	10

Extension Version	Code Review Findings
1.0.0	10

Files with findings

4 distinct paths — top paths by unique finding count:

background_js/root.js5
background_js/helper.js3
background_js/utils.js1
background.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background_js/helper.js (line 3)	The `exec` helper runs an arbitrary string `b` (sourced ultimately from the remote `loki` payload) inside any tab via `chrome.scripting.executeScript`, executing it through Sval. Combined with `<all_urls>` host permis…	1.0.0
2	Data Exfiltration	critical	background_js/root.js (line 107)	`getParamsFromStorePage` scans every open tab's URL looking for the Chrome Web Store referrer (with `utm_*` parameters) so the operator can attribute installs to a paid traffic source. Worse, `SendInstallUpdateEvent` …	1.0.0
3	Remote Code Loading	critical	background_js/helper.js (line 62)	The extension fetches arbitrary JavaScript from a remote server (`${defaultClickDomain}/loki`, defaulting to `https://myextension.online/loki`) and executes it through the Sval ECMAScript interpreter with `sandBox: fa…	1.0.0
4	Remote Code Loading	critical	background_js/helper.js (line 509)	A Chrome alarm re-invokes `loki()` every five minutes, continuously polling the attacker-controlled server for fresh JavaScript to execute via the Sval interpreter. This converts the extension into a live command-and-…	1.0.0
5	Obfuscation	high	background_js/utils.js (line 1)	Every function body and top-level statement in the background scripts is padded with hundreds of inert literal expressions — random first-name pairs (`"Riley Jovanni"`) and numeric constants (`6046326`) — interleaved …	1.0.0
6	Privilege Escalation	high	background_js/root.js (line 342)	Immediately on install the extension enumerates every open tab on every origin and force-injects `tubes.js` into all of them. Combined with `<all_urls>` and `document_start` execution, this gives the extension early a…	1.0.0
7	Unauthorized Data Collection	high	background_js/root.js (line 132)	On install the extension reads every cookie set on `tds.myextension.online` (a traffic-distribution / affiliate tracker domain) and concatenates them into an `installParams` string that is later sent back to `myextens…	1.0.0
8	Obfuscation	medium	background.js (line 1)	The MV3 service-worker entrypoint is wrapped in the same junk-statement obfuscation pattern, with the actual `importScripts` call buried inside hundreds of no-op literals. Hiding the real bootstrap among decoys is con…	1.0.0
9	Tracking	medium	background_js/root.js (line 215)	`setUninstallURL` is configured to open `myextension.online/v2/event?type=uninstall&subid=<uuid>...` when the user removes the extension, exfiltrating the persistent UUID and install metadata to the operator at uninst…	1.0.0
10	Tracking	medium	background_js/root.js (line 1)	A generic `SendMetric` beacon POSTs arbitrary key/value events plus the persistent `subid`/uuid and install params to `myextension.online/v2/metric`. Used throughout the codebase, this gives the operator a stable tele…	1.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	-	https://*
*	-	http://*
http:	-	http://:
https:	-	https://:
myextension.online	-	https://myextension.online
www.facebook.com	/video/video_data_async/	https://www.facebook.com/video/video_data_async/?video_id=${a}&fb_dtsg_ag=${b}&__user=${c}&__a=1`
www.instagram.com${c}`;a+=a.includes(	-	https://www.instagram.com${c}`;a+=a.includes(
vk.com	/al_video.php	https://vk.com/al_video.php?act=show_inline&al=1&video=${a}`

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

I have installed this program and use it if necessary.

АА

Айраз Айватов·30 Dec 2021

A very useful extension, makes it easier to download and distribute files into folders!

ПП

Прокоп Прокопыч·29 Dec 2021

A very useful extension, makes it easier to download and distribute files into folders!

ПП

Прокоп Про��опыч·29 Dec 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

ContentDownloadMaster

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating