Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Delete All Messages

CRITICAL RISKRemoved from Chrome Web Store

Delete All Messages

ID: hgiidlnejdlfoacoeleopkljhbckmlko

Could be malicious

Extension Info & Metadata

Status

Removed

Version

5.66.0

Size

0.18 MB

Rating

3.8/5

Reviews

4,406

Users

140,663

Type

Extension

Updated

Nov 24, 2020

Publisher Contextual Analysis

Author: Delete for facebookView Profile
MX records exist: No
Domain exists: No
Is disposable: No
Is role-based: Yes
Mailbox exists: No

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

140,663

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Delete All Messages from Facebook and Facebook Messenger - the fastest and easiest way to delete messages from facebook.

Clean all conversations at once (or) choose and delete multiple messages at once. Delete all messages lets you delete all your messages (including group conversations) by one click. You can also rate the extension to help other people discover our extension as well. ----- Disclaimer: "Facebook", the Facebook logo, and the Messenger logo are registered trademarks of Facebook, Inc. This software has no affiliation with Facebook, Inc. Terms of Use: Use this extension at your own risk. No guarantee or warranty is given. The author shall not be held liable for any damage or loss of data caused by its use. Usage of our extension means that you agree to these terms. We are using google analytics in order to gather data for the improvement of this extension, all data gathered is 100% anonymous - for further information check out our privacy policy. By clicking "Add to chrome", I accept and agree to installing "Delete All Messages" and also accept the Terms of Service and Privacy Policy. This extension takes over your default search settings and changes it to: https://bing.com Terms of Service: https://www.delete-all-messages.com/termsofservice Privacy Policy: https://www.delete-all-messages.com/privacy/

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High4

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
5.66.0 Code review	9

Extension Version	Code Review Findings
5.66.0	9

Files with findings

3 distinct paths — top paths by unique finding count:

js/functions.js5
js/background.js2
manifest.json2

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/functions.js (line 200)	The extension extracts Facebook's internal DTSG (Data Token for Secure GET) anti-CSRF token by scraping it directly from inline script elements on the Facebook page. This token is a session-bound security credential u…	5.66.0
2	Unauthorized Data Collection	critical	manifest.json (line 35)	The extension silently hijacks the browser's default search engine to redirect all searches through its own domain (search.delete-all-messages.com). This is a classic browser hijacking technique that enables the exten…	5.66.0
3	Unauthorized Data Collection	critical	js/functions.js (line 174)	The extension harvests multiple sensitive Facebook session identifiers from the page DOM: the user's account ID, session token, package cohort, page generation time, and revision number. These values together constitu…	5.66.0
4	Code Injection	high	manifest.json (line 15)	The manifest explicitly enables 'unsafe-eval' in the Content Security Policy, allowing dynamic code execution via eval(), new Function(), and similar constructs. This weakens the extension's security sandbox and is a …	5.66.0
5	Credential Theft	high	js/functions.js (line 36)	The extension constructs authenticated POST payloads embedding the user's harvested DTSG token (`fb_dtsg`) and account ID to call Facebook's internal `delete_thread.php` API. Using harvested credentials to invoke undo…	5.66.0
6	Unauthorized Data Collection	high	js/functions.js (line 417)	The extension calls Facebook's internal `threadlist_info.php` API endpoint using the user's harvested session token to enumerate all message thread IDs. This is an undocumented internal API and gives the extension ful…	5.66.0
7	Unauthorized Data Collection	high	js/functions.js (line 81)	The extension fetches full Facebook profile pages for each conversation participant and scrapes the raw HTML/JS to extract internal Facebook user IDs (`owning_profile`, `pageID`, `userID`, `fb://profile/`). This const…	5.66.0
8	Tracking	medium	js/background.js (line 56)	The background script dynamically injects and loads Google Analytics from an external URL at runtime, circumventing the extension's bundled code. The `ga('require', 'displayfeatures')` call specifically enables demogr…	5.66.0
9	Tracking	medium	js/background.js (line 86)	A comparison bug (`=` instead of `==`) causes the install redirect to fire on every extension event (install, update, browser restart), not just first install, repeatedly opening the developer's website. The periodic …	5.66.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
sizzlejs.com	-	http://sizzlejs.com/
jquery.org	/license	http://jquery.org/license
jsperf.com	/thor-indexof-vs-for/5	http://jsperf.com/thor-indexof-vs-for/5
www.w3.org	/TR/css3-selectors/	http://www.w3.org/TR/css3-selectors/#whitespace
www.w3.org	/TR/CSS21/syndata.html	http://www.w3.org/TR/CSS21/syndata.html#value-def-identifier
www.w3.org	/TR/selectors/	http://www.w3.org/TR/selectors/#attribute-selectors

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Ne fonctionne pas

Valère·3 Feb 2021

This is not working,,,, i tried several times... useless and waste of time...

Shanaka Ratnayake·2 Feb 2021

Doesn't delete messages

Bunny Hunny·30 Jan 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Delete All Messages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews