Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Direct for IG

CRITICAL RISKRemoved from Chrome Web Store

Direct for IG

ID: eoafhnefiaiofnknmohkdlfajhbmcmgk

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.0

Size

0.07 MB

Rating

4.7/5

Reviews

244

Users

102,794

Type

Extension

Updated

Jul 22, 2020

Publisher Contextual Analysis

Trusted

Author: http://ig-story.netView Profile
MX records exist: No
Domain exists: No
Is disposable: No
Is role-based: Yes
Mailbox exists: No

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

185,314

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Open Direct Messages for Instagram with one click as well as switch Direct with a News Feed.

Easily open direct messages for Instagram just with one click. It's a great tool for Instagram lovers who wants to stay in touch with friends as well as review the news feed like in mobile app. Direct for IG offers you all mobile interface functions with two additional buttons that simply switch between Instagram direct messages and news feed. You spend much less time to open Direct. Just a single click from your browser turns you to all Instagram features.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High1

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0 Code review	5

Extension Version	Code Review Findings
1.0	5

Files with findings

4 distinct paths — top paths by unique finding count:

js/background.js2
html/popup.html1
js/content/instaLinkListener.js1
js/content/userAgentChanger.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	html/popup.html (line 22)	The popup's entire UI is loaded from the publisher's external server via an iframe. This is effectively remote code loading: the publisher can change what 100K+ users see and interact with at any time without pushing …	1.0
2	Tracking	critical	js/background.js (line 12)	On every install/update event the extension beacons a unique user ID plus metadata to ig-story.net, then acts on the server's response: if the JSON contains a `url` field the extension silently opens that URL in a new…	1.0
3	Code Injection	high	js/content/userAgentChanger.js (line 1)	Injects an inline script tag at document_start into every Instagram iframe to override navigator.userAgent via __defineGetter__. While the stated purpose is to get mobile Instagram in the popup, this is arbitrary scri…	1.0
4	Network Interception	medium	js/background.js (line 86)	Strips the X-Frame-Options response header from all Instagram responses using webRequestBlocking. While functionally needed to embed Instagram in the popup iframe, this silently removes a browser security mechanism th…	1.0
5	Unauthorized Data Collection	medium	js/content/instaLinkListener.js (line 1)	This content script runs on every page (http:///, https:///) and attaches a MutationObserver that continuously scans the entire DOM of every website for instagram.com links and overrides their click behavior. Whil…	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///
ig-story.net	/app	https://ig-story.net/app
ig-story.net	/api/actions/	https://ig-story.net/api/actions/
ig-story.net	/uninstall/	https://ig-story.net/uninstall/
www.instagram.com	/direct/inbox/	https://www.instagram.com/direct/inbox/
www.instagram.com	/direct/new/	https://www.instagram.com/direct/new/
www.instagram.com	-	https://www.instagram.com/
www.w3.org	/2000/svg	http://www.w3.org/2000/svg

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

DOES NOT EVEN OPEN!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! SO ANGRY!!!!

Anonymous·14 Nov 2020

I just installed it and its not even opening!!

Serene Malaeb·23 Oct 2020

super its awsome social wb

ДМ

Дарья Майер·18 Aug 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Direct for IG

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews