Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Copy Content to RM11

CRITICAL RISKRemoved from Chrome Web Store

Copy Content to RM11

ID: allgbbncleocgacobkabcinbknanlglb

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

2.11

Size

0.15 MB

Rating

0.0/5

Reviews

Users

Type

Extension

Updated

Jul 21, 2026

Publisher Contextual Analysis

Author: RM11View Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

A Chrome extension to copy content to RM11

In just 3 simple steps, you can copy your posts and media from other platforms to SweetFans.

User Growth

Showing data from Jan 26, 2025 to Apr 26, 2026

Versions

+5.41%(+2 users)

Compared to 3 months ago

8 versions released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High3

Medium1

Low1

Versions scanned

Showing 1 of 11 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.8 Code review	10

Extension Version	Code Review Findings
2.8	10

Files with findings

2 distinct paths — top paths by unique finding count:

js/background.js7
js/content.js3

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/background.js (line 7)	Uses chrome.webRequest.onBeforeSendHeaders on <all_urls> to intercept outgoing OnlyFans authentication requests and extract the user's authorization headers (session tokens, user-agent, app-level signing headers). The…	2.8
2	Credential Theft	critical	js/content.js (line 183)	Reads OnlyFans' anti-bot signing token `bcTokenSha` from localStorage and bundles it with the OnlyFans session cookie (`sess`), user id, and a hardcoded app token, then forwards the whole package to the remote api.rm1…	2.8
3	Data Exfiltration	critical	js/background.js (line 761)	Downloads arbitrary media URLs (OnlyFans/Fansly private/subscription-gated media) from the background context with <all_urls> permission, then uploads them to rm11.com-controlled S3 URLs via signed requests. Running i…	2.8
4	Data Exfiltration	critical	js/content.js (line 207)	Reads the Fansly session (including `activeSession.token`) from the page's localStorage and uses it to paginate the victim's Fansly timeline API up to 34 pages, uploading each page's posts and media to api.rm11.com. T…	2.8
5	Network Interception	critical	js/background.js (line 100)	Dynamically registers a webRequest listener that captures headers from the victim's OnlyFans posts API calls, then triggers a content-script replay of the exact request with `isCopyTag:1` appended to bypass the listen…	2.8
6	Credential Theft	high	js/background.js (line 33)	Handler reads all cookies (including HttpOnly cookies inaccessible to page JS) for an arbitrary URL passed in the message, then returns them to the caller. Used throughout the extension to harvest rm11.com session coo…	2.8
7	Network Interception	high	js/content.js (line 13)	Replays the victim's OnlyFans API request using the stolen authorization headers (captured by the background webRequest listener) and auto-paginates by scrolling (see scrollToBottom). The `isCopyTag:1` marker is appen…	2.8
8	Unauthorized Data Collection	high	js/background.js (line 52)	Uses chrome.scripting.executeScript to inject code into a target tab (matched by arbitrary URL from the message) and dump the entire localStorage back to the extension. This is cross-origin localStorage exfiltration v…	2.8
9	Obfuscation	medium	js/background.js (line 868)	Hardcoded HMAC-SHA1 secret key embedded in the extension is used to sign every request to api.rm11.com. The signing scheme plus `importScripts('../lib/crypto-js.min.js')` (file not present in bundle, so it is dynamica…	2.8
10	Obfuscation	low	js/background.js (line 1)	Service worker imports a library from `../lib/crypto-js.min.js` that is not included in the shipped bundle (`js/` only). At runtime this either fails silently or attempts to resolve from a packaged path not visible he…	2.8

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.fanvue.com	/*	https://www.fanvue.com/*
apiv3.fansly.com	/api/v1/account/media	https://apiv3.fansly.com/api/v1/account/media?ids=${list2.join(
fansly.com	/*	https://fansly.com/*
localhost	-	http://localhost:3000
api.faye-test.link	-	https://api.faye-test.link
faye-test.link	-	https://faye-test.link
rm11.com	-	https://rm11.com
api.rm11.com	-	https://api.rm11.com
onlyfans.com	/api2/v2/users/me	https://onlyfans.com/api2/v2/users/me
onlyfans	//.com/api2/v2/users/$%7BaccountId%7D/posts(//	https://onlyfans\\.com/api2/v2/users/${accountId}/posts(\\?.*

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Copy Content to RM11

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 11 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating