Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Data Shield for Chrome

CRITICAL RISKRemoved from Chrome Web Store

Data Shield for Chrome

ID: edbhdbhgdbanjhdnpjcianjgfmdkgbcf

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.2.4129

Size

0.44 MB

Rating

4.7/5

Reviews

Users

100,000

Type

Extension

Updated

Jul 22, 2025

Publisher Contextual Analysis

Author: https://wiseghostapp.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

760,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Ghost will warn you about search terms that may lead to data leaks.

Phishing attacks are becoming more and more common, and many websites might try to steal your personal information without your knowledge. Ghost has you covered! This extension uses advanced search scans to help keep your searches safe and your data protected. Features: - Ghost sets Bing as your default search engine to route your searches through our secure safety engine. We ensure every search you make is thoroughly scanned for potential threats before it reaches you. - Stay informed with real-time alerts whenever a search is flagged as dangerous. Ghost makes sure you're never caught off guard. Say hello to safer searching — knowing Ghost has got your back! 👻. For any questions, please contact us at [email protected]

User Growth

Showing data from Jan 18, 2024 to Jan 16, 2025

Versions

No change in user count

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 23 ratings

Average Rating

Current: 4.70 / 5.0-0.01

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High6

Medium1

Low0

Versions scanned

Showing 1 of 6 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.4129 Code review	9

Extension Version	Code Review Findings
1.2.4129	9

Files with findings

3 distinct paths — top paths by unique finding count:

background.js7
ghostKA.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 1115)	A server-controlled DOM manipulation/exfiltration agent is injected into arbitrary tabs via chrome.scripting.executeScript. The injected handler exposes a postMessage command dispatcher with verbs to create DOM elemen…	1.2.4129
2	Data Exfiltration	critical	background.js (line 1195)	The injected agent can, on command from the background script (itself server-driven), attach event listeners to any DOM/window object and JSON.stringify the full event object plus arbitrary property paths, forwarding …	1.2.4129
3	Network Interception	high	background.js (line 2898)	Registers webRequest listeners across <all_urls> for every request type (main_frame, sub_frame, xmlhttprequest, script, stylesheet, image, ping, other) and captures response headers and the Referer header on outbound …	1.2.4129
4	Obfuscation	high	background.js (line 822)	All outbound communications with the backend are optionally XOR-obfuscated (key=255 by default, server-configurable via c.v) and re-encoded with the custom 'application/x-binary' content-type. Responses are decoded th…	1.2.4129
5	Privilege Escalation	high	background.js (line 3075)	The context-menu items are populated from server-controlled configuration (contextMenuItems pulled via u.i()). Depending on the id prefix the server ships, a click opens attacker-chosen URLs (genOpen*), uninstalls the…	1.2.4129
6	Tracking	high	manifest.json (line 31)	Manifest hijacks the browser's default search engine to route every user query through search.wiseghostapp.com and send keystrokes to ext.wiseghostapp.com/api/ext/suggest. This is classic search-hijacking monetization…	1.2.4129
7	Tracking	high	ghostKA.js (line 48)	Content script injected into every page (<all_urls>) probes the extension runtime every 30s and, if the connection fails (extension disabled/removed), beacons the current page's hostname and extension version to ext.w…	1.2.4129
8	Unauthorized Data Collection	high	background.js (line 627)	Every server 'hit' (including periodic pings) bundles language, local time, timezone, active tab id, idle state, all installed extensions (requested via the management permission), device id, runtime id, and the user'…	1.2.4129
9	Tracking	medium	background.js (line 5534)	On install/startup the extension registers an uninstall URL pointing at <apiDomain>/srv/sec/uninstall?eid=<runtime_id>, reporting to the vendor whenever the user removes the extension and tagging them by runtime id. T…	1.2.4129

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


wiseghostapp.com	-	https://wiseghostapp.com
ext.wiseghostapp.com	-	https://ext.wiseghostapp.com
ext.ghostsapp.com	-	https://ext.ghostsapp.com
wiseghostapp.com	/feedback.html	https://wiseghostapp.com/feedback.html
idprotect.trendmicro.com	/en-us/leakchecker	https://idprotect.trendmicro.com/en-us/leakchecker
ext.wiseghostapp.com	/src/background.js.e8d33da8ccf204237f30.map	https://ext.wiseghostapp.com/src/background.js.e8d33da8ccf204237f30.map
ext.wiseghostapp.com	/srv/sec/rip	https://ext.wiseghostapp.com/srv/sec/rip
ext.wiseghostapp.com	/src/ghostKA.js.e8d33da8ccf204237f30.map	https://ext.wiseghostapp.com/src/ghostKA.js.e8d33da8ccf204237f30.map
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Inter:wght@400;500&display=swap
ext.wiseghostapp.com	/src/style.css.e8d33da8ccf204237f30.map*/	https://ext.wiseghostapp.com/src/style.css.e8d33da8ccf204237f30.map*/

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

We invite you to join us in our partnership to expand your revenue and grow your chrome extension. Let's explore how we can help you. Learn more at: https://extensionbuysell.com Looking forward to working with you!

Madison Francis·19 Sept 2024

Hello, I hope you're having a splendid day! I am currently seeking opportunities to expand my business operations by investing in extensions with a significant user base, beginning from 50,000 users and up. No matter if your extension has a modest user base or counts its users in the millions, I am interested and ready to negotiate a purchase. If you are in possession of such an extension and looking to turn it into a profit, please consider reaching out to me. We can discuss the price and proceed with a transparent and secure transaction through a trusted escrow service based in the United States. It's great that Google allows the transfer of extension ownership between accounts, so your Google account ownership will remain intact. If you have any needs, please contact us via the following contacts Whatsapp: +1 (248) 896‑8035 Telegram: t.me/harryysandersonn

Abner Wirtz·7 Jun 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Data Shield for Chrome

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 6 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating