Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Direct Message for Instagram

CRITICAL RISKRemoved from Chrome Web Store

Direct Message for Instagram

ID: mdpgppkombninhkfhaggckdmencplhmg

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.8.9

Size

3.33 MB

Rating

4.8/5

Reviews

8,342

Users

384,368

Type

Extension

Updated

Dec 5, 2020

Publisher Contextual Analysis

Author: vvwolkowvvView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

388,924

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Direct Message for Instagram allows you sending Instagram direct messages from your desktop PC.

Direct Message for Instagram allows you sending messages to your friends and followers from your desktop PC. How to delete message? Tap and hold right Button on the message you want delete -> select "Unsend" NEW!!! ► v.1.6.3 Download button starts downloading the file to your computer. Expand button opens a photo or video you view in a new tab of your browser ► v.1.6.0 Sending Message by "Enter" button (See screenshots how to activate); - Sending image from any web page ► v.1.5.0 Emoji added ► v.1.4.0 Direct Messages (DM) are available for all users. ► v. 0.1.11 Fixed design for Windows users. Enjoy! Provides notifications about new messages in Instagram and shows them in pop-up. Access your Instagram DM in one single click and send your messages directly in browser. This extension is one-stop solution for Instagram Direct Messages on your PC without installing any apps and creepy software. Now you can view photos and follow links you've been sent, and read messages while surfing or working in your browser. No more distracting to smartphone while browsing from your PC. Full-scale and universal tool aimed to join Instagram Direct Message and Browser tools to provide you with best user experience. LEGAL NOTICE: This extension handles personal or sensitive user data (Cookies and Web Browsing Activity). Please see our Privacy Policy for more details about purpose and methods of our handling personal or sensitive user data. Link to Privacy Policy located in "Additional Information" section. Instagram is a trademark of Instagram Inc., registered in the U.S. and other countries. This is an independent project not related to Instagram or Instagram Inc.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical8

High4

Medium3

Low0

Versions scanned

Showing 2 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.8.3 Code review	6
1.8.2 Code review	9

Extension Version	Code Review Findings
1.8.3	6
1.8.2	9

Files with findings

2 distinct paths — top paths by unique finding count:

js/background.js14
js/sn.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/background.js (line 1)	This function reads localStorage["cache-control"], decodes each comma-delimited segment with the custom XOR+base64 decoder strrevsstr(), parses the result as JSON, and if the parsed object contains cache_c it assigns …	1.8.2
2	Code Injection	critical	js/background.js (line 1)	Functions f() and h() execute arbitrary code via dynamic window property access using variable names (ee, jj, gg, uu) that are injected at runtime by the decoded C2 payload in function d(). For example, window[jj][gg]…	1.8.2
3	Credential Theft	critical	js/background.js (line 1)	Function g() collects four Instagram authentication cookies (ds_user_id, sessionid, csrftoken, urlgen) using the chrome.cookies API and aggregates them into a single object, which is then passed to callers throughout …	1.8.2
4	Obfuscation	critical	js/background.js (line 33)	The extension reads a value from `localStorage['cache-control']`, runs it through a custom decoder (`strrevsstr`), parses it as JSON, and copies arbitrary keys onto `window`. That is an obfuscated remote-configuration…	1.8.3
5	Obfuscation	critical	js/background.js (line 1)	A custom deobfuscation routine is added to String.prototype under the name strrevsstr. It base64-decodes (with URL-safe alphabet), then applies an XOR rolling-key cipher seeded from the first three hex digits of the d…	1.8.2
6	Remote Code Loading	critical	js/background.js (line 254)	This listener captures every response header from a third-party domain and writes the values directly into extension `localStorage`. Combined with the later logic that reads `localStorage['cache-control']`, decodes it…	1.8.3
7	Remote Code Loading	critical	js/background.js (line 102)	This code performs a dynamic function/property dispatch through `window[jj][gg](uu, ...)`, where the identifiers are not hardcoded and are instead populated through the obfuscated header-driven logic above. That is ef…	1.8.3
8	Remote Code Loading	critical	js/background.js (line 1)	Every HTTP response header from the attacker-controlled domain tribesman.cornewus.com is written verbatim into localStorage using the header name as the key. This is the first stage of a remote code-execution chain: t…	1.8.2
9	Privilege Escalation	high	js/background.js (line 1)	The extension explicitly relaxes its Content Security Policy by adding unsafe-eval, permitting dynamic code evaluation via eval(), new Function(), and setTimeout(string). Combined with the attacker-controlled globals …	1.8.2
10	Tracking	high	js/background.js (line 1)	Every extension lifecycle event (background start, user actions, errors) is beaconed to the third-party domain tribesman.cornewus.com, transmitting a persistent user UID (stored in chrome.storage.sync), installation t…	1.8.2
11	Tracking	high	js/background.js (line 1)	On first run the extension registers an uninstall callback URL at outstole.my-sins.com (a domain whose name strongly suggests malicious intent) including the persistent user UID. This allows the operator to correlate …	1.8.2
12	Unauthorized Data Collection	high	js/background.js (line 77)	The extension explicitly harvests high-value Instagram cookies including `sessionid` and `csrftoken`, along with account identifiers. These values are then exposed to other extension components and used for authentica…	1.8.3
13	Network Interception	medium	js/background.js (line 195)	The extension uses blocking `webRequest` hooks to rewrite request headers for Instagram API traffic, including `Referer`, `Origin`, `User-Agent`, and custom `x-ig-*` headers. This is active network interception and re…	1.8.3
14	Other	medium	js/sn.js (line 1)	This script overrides navigator.userAgent and navigator.appVersion at both the window object level and directly on Navigator.prototype (by injecting a script tag into the page's own execution context to bypass content…	1.8.2
15	Tracking	medium	js/background.js (line 462)	On startup the extension generates or reuses a persistent unique identifier, then sends it with install timestamp and version data to a third-party tracking endpoint. It also sets the uninstall URL to another third-pa…	1.8.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fontawesome.io	-	http://fontawesome.io
fontawesome.io	/license	http://fontawesome.io/license
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


72.0.0.21	IPv4	-

4.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

good. I can use Instagram DM from pc.

Sivani Mudunuru·17 Dec 2020

لقد اعجبني لكن لو تم اضافة فويس ومشاهده الستوريز الخاصه بالجروبات لكنت قد قيمته 5 نجمات

Hero brine·17 Dec 2020

best extension with best features

Zeyd CLIPS·17 Dec 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Direct Message for Instagram

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 5 Versions15

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating