Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Delete All Messages for Facebook™

CRITICAL RISKRemoved from Chrome Web Store

Delete All Messages for Facebook™

ID: peibcpfenpdcfbimikogecbihhcdalcd

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.0.2

Size

0.20 MB

Rating

4.8/5

Reviews

234

Users

201,032

Type

Extension

Updated

Sep 1, 2020

Publisher Contextual Analysis

Author: http://henrylondon.netView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

201,032

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Allows you to delete all messages on Facebook in one click. A simple message cleaner in your browser.

Simply and effectively remove all messages from your FB account. You can also select several specific messages and then delete them in one click. Once you install this extension, go to Facebook and look for the extension icon in the top right of your address bar. Click the icon to open the conrol panel. Remember, to ensure the work of the extension need to be authorized on Facebook. Use this extension at your own risk. Please delete your messages carefully. The developer is not liable for any moral or material damage incurred to you related to the removal of messages by this extension. Using "Delete All Messages for Facebook™" Chrome Extension means that you agree to these terms. Facebook™ is a trademark of Facebook ™ Inc. This extension, namely “Delete All Messages for Facebook ™" has no connection to Facebook ™ inc.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High2

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.2 Code review	7

Extension Version	Code Review Findings
1.0.2	7

Files with findings

4 distinct paths — top paths by unique finding count:

js/content.js3
js/background.js2
js/userinfo.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/userinfo.js (line 1)	The `userinfo.js` module deliberately scrapes Facebook's internal page bootstrap scripts to extract the user's `accountId` (Facebook account ID), `fb_dtsg` CSRF token (from `DTSGInitialData`), `revision`, `pkgCoHort`,…	1.0.2
2	Network Interception	critical	js/background.js (line 1)	The background script registers a `webRequest.onBeforeRequest` listener over all `://.facebook.com/*` URLs with the `requestBody` extra-info flag, giving it access to the raw bytes of every POST body Facebook sends.…	1.0.2
3	Remote Code Loading	critical	js/content.js (line 1)	When `enable_btn` is false in chrome.storage, the content script reads `a.d.src` from the extension's stored config and dynamically injects an external script tag into the page head on every non-Facebook page. The `sr…	1.0.2
4	Code Injection	high	manifest.json (line 30)	The manifest explicitly enables `'unsafe-eval'` in the content security policy. Combined with the `remote_code_loading` backdoor in the content script, this allows dynamically loaded scripts to themselves use `eval()`…	1.0.2
5	Unauthorized Data Collection	high	js/content.js (line 1)	The content script constructs authenticated Facebook API payloads using the harvested `fb_dtsg` CSRF token and `accountId`. These payloads are used to call Facebook's private internal APIs (`/ajax/mercury/delete_threa…	1.0.2
6	Other	medium	js/content.js (line 1)	The content script references a hardcoded extension ID `idnpnpdgfopkoibbhemhdinhcbghpokf` — which is different from the installed extension's actual ID (`peibcpfenpdcfbimikogecbihhcdalcd`). The popup.html also links t…	1.0.2
7	Tracking	medium	js/background.js (line 1)	The extension generates a persistent UUID (stored as `UID` in `localStorage`) that uniquely identifies the browser/user across sessions. This UID is then included in every `getSettings` message response sent to any re…	1.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


g-face.site	-	https://g-face.site/
chrome.google.com	/webstore/detail/delete-all-messages-for-f/idnpnpdgfopkoibbhemhdinhcbghpokf	https://chrome.google.com/webstore/detail/delete-all-messages-for-f/idnpnpdgfopkoibbhemhdinhcbghpokf
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
g-face.site	/delete-all-messages/	https://g-face.site/delete-all-messages/
web.facebook.com	/messages	https://web.facebook.com/messages
web.facebook.com	/messages%60,FB_MESSAGE_URL:	https://web.facebook.com/messages`,FB_MESSAGE_URL:
web.facebook.com	/messages%60%7D	https://web.facebook.com/messages`}
www.facebook.com	-	https://www.facebook.com
www.facebook.com	/messages/t/	https://www.facebook.com/messages/t/
www.facebook.com	/messages/	https://www.facebook.com/messages/

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.7 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

Didn't work. Said "no messages" even though i was looking at them.

Gene Reigns·6 Sept 2020

i deleted the old version i had on google chrome and reinstalled it and it worked great! It was really fast.. I had messages from 2013 and it deleted them in a matter of seconds.

Saul Diaz·26 Aug 2020

Best extension on the market. Worked 100% the first time and deleted years worth of messages in seconds.

AR Maruf khan·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Delete All Messages for Facebook™

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews