Chrome Web StoreCaution required
Suspicious in code review (v7.4.3.55)
Our reviewer found behaviour consistent with malware in version 7.4.3.55, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
What our analysis found
CRM DE ELITE : CRM no whatsapp, Automações e Ferramentas pa… is rated caution by Extension Auditor. Our code review reported 2 findings (2 high), led by remote code loading. It comes from a publisher with 20 extensions and was last updated in October 2026.
Key findings
- High
Remote Code Loading
Every 10 minutes the background fetches `[domain withheld] and forwards the entire parsed response — including a `remote_code` URL field — to the WhatsApp content script via the `Update_DomSelector` message. The `v()` function, invoked when the content script sends an `inject-code` message, extracts that `remote_code` URL from the same config, indicating the content script (whose main bundle file is missing from this extraction) uses it to dynamically load and execute additional JavaScript. This gives the publisher's server the ability to update extension behaviour — including injecting new code — at any time without a CWS update, bypassing Google's review process.
- High
Credential Theft
On install, function `y()` (line 122) queries every open Chrome Web Store tab and extracts a `bearer_token` query parameter from the tab's URL. Function `k()` then silently closes all open WhatsApp tabs and all Chrome Web Store tabs (`l()` calls at line 108) before re-opening WhatsApp with the harvested token embedded in the URL (`[domain withheld]). Closing the source tab after extracting the token is an unusual cover-the-tracks pattern; the extension already has a direct `onMessageExternal` channel from `[domain withheld]` for auth token delivery, making this tab-scraping flow redundant for legitimate purposes and consistent with covert token interception.
Analyst notes
The contains a remote-code-loading mechanism that fetches `[domain withheld] every 10 minutes and forwards the full response (which includes a `remote_code` URL field) to the WhatsApp content script via the `Update_DomSelector` message — giving the publisher's server dynamic behavioural control post-installation. Additionally, on install the extension scans all open Chrome Web Store tabs for a `bearer_token` URL parameter, silently closes both those tabs and all open WhatsApp tabs, then re-opens WhatsApp with the extracted token appended to the URL; this tab-scraping and tab-closure pattern is not the expected flow for `externally_connectable` auth (which already works via `onMessageExternal`). The internal IoC note explicitly tags this extension as 'WaSteal' malware per [domain withheld], a third-party signal that corroborates the suspicious code patterns; the permhash cluster (93% malicious, 16 k peers) further raises suspicion. The permission set and third-party risk score are consistent with a legitimate WhatsApp CRM, but taken together the IoC, the remote-config relay, and the unorthodox tab-scraping auth flow point to likely-malicious intent rather than a false positive.
CRM DE ELITE : CRM no whatsapp, Automações e Ferramentas para venda Chrome extension security report
ID: nlbdmcikemaghcoeoblmlkdlhiggnhin
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- ewdht
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Email Change History
Screenshots & videos
Install growth
About this extension
CRM DE ELITE é um CRM para WhatsApp Web. Organize seus chats e otimize seus negócios no WhatsApp Web
Read the publisher’s full description
Experimente as novas funcionalidades do CRM DE ELITE, projetadas para oferecer mais controle sobre seus leads e aumentar suas prospecções de clientes. Com envios em massa e exportação de contatos. Principais Funcionalidades: ✔ Rastreie pedidos: Monitore suas entregas, vincule o rastreamento aos clientes e acompanhe o progresso de forma eficiente. ✔ Envio em massa para seus contatos ou contatos importados via CSV ✔ Criação de abas personalizadas para fácil localização de contatos importantes ✔ Visão Kanban para organizar seus leads ✔ Envio de mensagens para números não salvos na agenda ✔ Notas personalizadas para cada contato ✔ Criação de lembretes para retornar ligações ✔ Agendamento de reuniões no Google Agenda ✔ Configuração de lembretes simples com notificações ✔ Banco de respostas rápidas para envio com um clique ✔ Exportação de todos os contatos de grupos ✔ Suporte a múltiplos idiomas (português, espanhol, inglês) ✔ Função de borrar mensagens para criação de vídeos tutoriais. ✔ Assistente AI — Sua inteligência artificial pronta para ajudar! Otimize seu tempo com um assistente inteligente, rápido e sempre disponível. Responda dúvidas, automatize tarefas, gere textos, traduções e muito mais com o poder da IA. Ideal para profissionais, equipes e quem busca praticidade no dia a dia. Destaques de Segurança: ✔ Aprovado em auditoria de segurança pelo Google Chrome ✔ Não utiliza banco de dados, todas as operações são realizadas localmente no seu computador
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from ewdht
Popular in Tools
- Claude20,000,000 users
- Zotero Connector9,000,000 users
- ChatGPT8,000,000 users
- Browsec VPN - Free VPN for Chrome8,000,000 users
- WPS PDF - Read, Edit, Fill, Convert, and AI Chat PDF with Ease7,000,000 users