Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Currently from AT&T

CRITICAL RISKRemoved from Chrome Web Store

Currently from AT&T

ID: fghadmiogcoldedohbobjngledegaboe

Could be malicious

Supported Languages

🇹🇼Chinese (Traditional)

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

3.1.0

Size

0.82 MB

Rating

5.0/5

Reviews

Users

10,000

Type

Extension

Updated

Nov 8, 2023

Publisher Contextual Analysis

Author: YPartnerPublisherView Profile
Privacy: Privacy Policy
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 770 Broadway 9th Floor New York, NY 10003-9522 US

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,160

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

This extension sets currently.att.yahoo.com as your new tab and homepage, and sets your search engine to Currently from AT&T Search

Premium content and utilities are all just a click away with the Currently Homepage Extension, powered by Yahoo! This unique homepage experience, brought to you by AT&T, will launch each time you open your browser to help you begin your tasks or exploration. Find what you need every time you open a tab: - Top stories and trending topics - Local weather and daily horoscopes - Engaging online games and crosswords - Easy access to your AT&T Mail powered by Yahoo - Links to myAT&T and additional AT&T Services - Looking for something else? Type in the search bar or toolbar to discover more *This extension will set currently.att.yahoo.com as your homepage and new tab page.*

User Growth

Showing data from Aug 16, 2023 to Aug 14, 2024

Versions

+11.11%(+1,000 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High5

Medium4

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.1.0 Code review	10

Extension Version	Code Review Findings
3.1.0	10

Files with findings

6 distinct paths — top paths by unique finding count:

background.js4
components/back/index.js2
browsergap-sw.js1
components/back/utils.js1
tracking-sw.js1
ui/notifyPresence.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	high	components/back/index.js (line 797)	Directly queries the Yahoo authentication cookies 'T' and 'Y' (Yahoo's session-identity cookies) via chrome.cookies.get to determine login state. Touching authenticated session cookies from a browser extension is a se…	3.1.0
2	Credential Theft	high	components/back/index.js (line 820)	Fetches a Yahoo Finance 'crumb' (a CSRF anti-forgery token bound to the logged-in user's session) from partner-query.finance.yahoo.com and uses it together with the captured T/Y session cookies to call authenticated p…	3.1.0
3	Network Interception	high	background.js (line 291)	Uses declarativeNetRequest to inject a custom 'x-extensions-installed: hpset-v2' request header on every main-frame navigation matching ^https://(.).yahoo.com.$. This silently signals to Yahoo's servers that this sp…	3.1.0
4	Tracking	high	tracking-sw.js (line 12)	Builds and fires a tracking beacon to geo.yahoo.com containing a persistent client identifier (CTID), browser type/version, OS, accept-language locale, distribution/campaign codes, and install state. This fingerprints…	3.1.0
5	Tracking	high	background.js (line 40)	Schedules a recurring chrome.alarms 'livePing' every 240 minutes (4 hours) that fires a tracking beacon containing the user's CTID, OS, browser, version, locale, and partner code to geo.yahoo.com. This is persistent, …	3.1.0
6	Remote Code Loading	medium	background.js (line 160)	At install time the extension fetches a remote JSON 'distribution channel config' from https://search.yahoo.com/jf/ext/conf/hpset/{channel}.json, where {channel} comes from a URL parameter on the install page. The ser…	3.1.0
7	Tracking	medium	browsergap-sw.js (line 63)	Generates a 32-character pseudo-random CTID and persists it to chrome.storage.local on first run. This identifier is then attached to every outbound beacon (see tracking-sw.js sendBeacon), giving Yahoo a stable per-in…	3.1.0
8	Tracking	medium	background.js (line 73)	Sets a Yahoo uninstall URL enriched with campaign code, install timestamp, region, and an amp_desc fingerprint (browser+distribution code). When the user uninstalls, the browser is forced to send all of this attributi…	3.1.0
9	Unauthorized Data Collection	medium	components/back/utils.js (line 39)	Helper that reads arbitrary cookies via the cookies permission. It is invoked from FinanceModule.getLoginStatus to read the 'T' and 'Y' authenticated-session cookies from https://www.yahoo.com/, which are session/iden…	3.1.0
10	Tracking	low	ui/notifyPresence.js (line 1)	Script appears designed to run on yahoo.com pages to suppress overlays/promotional containers and tag the document body with classes that signal extension presence to Yahoo's page JavaScript. Combined with the x-exten…	3.1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.yahoo.com	-	https://www.yahoo.com/?fr=
www.yahoo.com	-	https://www.yahoo.com/
*.yahoo.com	/*	https://.yahoo.com/
chrome.google.com	/webstore/*	https://chrome.google.com/webstore/*
microsoftedge.microsoft.com	/addons/*	https://microsoftedge.microsoft.com/addons/*
www.yahoo.com	-	https://www.yahoo.com/?fr=yset_chr_ext_exit
www.yahoo.com	-	https://www.yahoo.com/?fr=yset_edge_ext_exit
search.yahoo.com	/jf/ext/conf/hpset/	https://search.yahoo.com/jf/ext/conf/hpset/
(.*	-	https://(.*
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

Showing 1 to 10 of 70 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


4.4.3.2	IPv4	-

5.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

love this so much I think att and yahoo are a great and awesome companies and if they can contact me cause i gor an investment for their to ski rocket

Rene Hernandez·21 Jan 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Currently from AT&T

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating