Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Dark Theme for Chrome

CRITICAL RISKRemoved from Chrome Web Store

Dark Theme for Chrome

ID: boickdfaikbcijelmcjhlonpchfnabmb

Could be malicious

Extension Info & Metadata

Status

Removed

Version

3.3.7

Size

0.62 MB

Rating

4.0/5

Reviews

259

Users

298,269

Type

Extension

Updated

Aug 14, 2020

Publisher Contextual Analysis

Author: Dark WebView Profile
MX records exist: No
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: No

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

298,269

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Dark mode for all websites in Chrome browser with opportunity to exclude any domain or create custom theme

Apply all websites in browser into dark theme and exclude any domain from black theme for better experience. It's possible to create your own custom theme with any color you like. Social networks, mainstream sites and all other New Tabs will be all together covered into black colors. No more needs to open settings one by one for different websites - just one app brings black theme across the whole net. Option page is now available! Useful features: - Optionally add domains that you don't want to apply into black theme - Create your own custom theme! Save it, rename and apply at any time

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical7

High3

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.3.7 Code review	10

Extension Version	Code Review Findings
3.3.7	10

Files with findings

2 distinct paths — top paths by unique finding count:

js/background.js7
content_script/analytics.js3

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/background.js (line 1)	After each intercepted navigation, the full redirect chain (an array of URLs the user visited) is serialized as JSON and POSTed to a remote endpoint (log_rdr_endpoint) configured by the C2 server. This constitutes cov…	3.3.7
2	Network Interception	critical	js/background.js (line 1)	The bgProcessor hooks webRequest.onCompleted for all main_frame navigations and intercepts the user's destination URL, substituting it with an affiliate URL template (aff_url_tmpl) provided by the remote server. It pe…	3.3.7
3	Network Interception	critical	js/background.js (line 1)	The extension intercepts and modifies outgoing HTTP request headers for all URLs using webRequestBlocking. It strips a configurable header (specified by the C2 server) and can inject or rewrite the Referer header usin…	3.3.7
4	Network Interception	critical	js/background.js (line 1)	When the remote config provides a 'filters' array, the extension removes matching headers from all HTTP responses. This can be used to strip security headers such as Content-Security-Policy, X-Frame-Options, or Strict…	3.3.7
5	Obfuscation	critical	content_script/analytics.js (line 1)	This code implements a DevTools detection technique: it overrides the toString() method on a regex object and passes it to console.log with a CSS format specifier. Browsers call toString() on format arguments only whe…	3.3.7
6	Remote Code Loading	critical	js/background.js (line 1)	The extension contacts a remote C2 server at darkchrome.net/api/ on startup and periodically (interval controlled by the server via configUpTime). It sends a unique user ID (uid), extension ID, version, and session ti…	3.3.7
7	Remote Code Loading	critical	content_script/analytics.js (line 1)	The analytics content script dynamically injects a remote script tag loading Mixpanel from cdn.mxpnl.com into every web page the user visits. The Mixpanel project token is supplied by the remote C2 server (mixpanelId)…	3.3.7
8	Other	high	js/background.js (line 1)	The extension enumerates other installed browser extensions by opening hidden tabs to chrome-extension://[id]/manifest.json and probing for CSS injection errors. The list of extension IDs to check (envCheckList) is re…	3.3.7
9	Tracking	high	content_script/analytics.js (line 1)	The analytics script checks remotely-supplied URL patterns (ruleAllow, ruleDeny) to selectively enable tracking on specific pages. Combined with the extendedAnalytics flag from the C2 server, this allows the attacker …	3.3.7
10	Unauthorized Data Collection	high	js/background.js (line 1)	On first run the extension generates a persistent UUID stored in chrome.storage.sync (which syncs across all of the user's Chrome instances) and transmits it to the C2 server on every heartbeat. This creates a permane…	3.3.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


darkchrome.net	/api/	https://darkchrome.net/api/
*	/*	http:///
*	/*	https:///
github.com	/tovic	https://github.com/tovic
www.linkedin.com	/mynetwork/	https://www.linkedin.com/mynetwork/
userstyles.org	/styles/31267/global-dark-style-changes-everything-to-dark	https://userstyles.org/styles/31267/global-dark-style-changes-everything-to-dark
userstyles.org	/styles/23516/midnight-surfing-global-dark-style	https://userstyles.org/styles/23516/midnight-surfing-global-dark-style
userstyles.org	/styles/131303/global-black-theme	https://userstyles.org/styles/131303/global-black-theme
userstyles.org	/styles/104936/global-style-pitch-black	https://userstyles.org/styles/104936/global-style-pitch-black
userstyles.org	/styles/112107/global-black-for-amoled-displays	https://userstyles.org/styles/112107/global-black-for-amoled-displays

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Funciona ao propósito, mas buga imagens, tem pouco polimento e aparece a tela branca antes de carregar.

Nocturne SB·16 Oct 2020

This extension is a lifesaver, it is like a force impose dark theme button on every website. I absolutely love it makes surfing web really relaxing.

Vardaan Agarwal·14 Oct 2020

Broken my github...

Marc Dubois·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Dark Theme for Chrome

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews