Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: 每天星座运势

CRITICAL RISKRemoved from Chrome Web Store

每天星座运势

ID: dkooigndpgfgllpgadkminncakpopkeg

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Removed

Version

9.15.32

Size

0.19 MB

Rating

3.0/5

Reviews

Users

10,000

Type

Extension

Updated

Dec 14, 2023

Publisher Contextual Analysis

Trusted

Author: sundanqcView Profile
Privacy: Privacy Policy
Country: 中国
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 浙桥路277号2号楼上海 201200 中国

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

1,020,081

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

每天星座运势，可以查看当天的星座运势，星座幸运色，幸运数字以及工作指数；也可以查看本周，当月，年度星座运势，年度幸运石和感情运势。

可以查看月份的星座运势状态，查看年度事业运势，财运指数，年度密码。

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical8

High5

Medium0

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
7.53.81 Code review	13

Extension Version	Code Review Findings
7.53.81	13

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js9
js/content.js3
rules.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/background.js (line 685)	The 'geth' background handler receives the encoded page URL from content.js and POSTs it along with the browser identifier ('n') to 'http://xz.xtione.com/zodiac/logc'. The parameter 'ht' carries the full URL of every …	7.53.81
2	Data Exfiltration	critical	js/content.js (line 71)	The addItem function injects a server-controlled iframe into the current webpage. The iframe src includes the current page URL as the 'up' query parameter, meaning each iframe load request leaks the user's browsing lo…	7.53.81
3	Network Interception	critical	js/background.js (line 442)	Function j() installs arbitrary declarativeNetRequest rules received from the C2 server. The rules structure passes 'action' and 'condition' directly from the server payload, meaning the attacker can dynamically deplo…	7.53.81
4	Privilege Escalation	critical	js/background.js (line 604)	The 'setstar' handler receives a custom-obfuscated payload ('base') from the C2 server, decodes it with the module-828 decoder, parses it as JSON, and passes the result directly to j() which installs it as dynamic dec…	7.53.81
5	Remote Code Loading	critical	js/background.js (line 757)	Function A is registered as a chrome.tabs.onUpdated listener and fires on every tab navigation across all URLs. It consults the remotely fetched config object 'g' (from C2 server xz.xtione.com) for URL-match rules ('u…	7.53.81
6	Remote Code Loading	critical	js/background.js (line 719)	Function S() executes the server-controlled tab redirect: it picks a random URL from the remotely configured 'u' array and either creates a new active tab or silently updates the current tab's URL. The target URLs com…	7.53.81
7	Remote Code Loading	critical	js/background.js (line 311)	Function d() fetches the primary behavioral configuration from 'http://xz.xtione.com/zodiac/openStar.json', passing device fingerprint parameters (UUID, browser, version, timestamp). The response is decoded with the c…	7.53.81
8	Unauthorized Data Collection	critical	js/content.js (line 100)	The content script sends the full URL of every visited page (once per domain per day) to the background via the 'geth' message, which logs it to 'http://xz.xtione.com/zodiac/logc'. The date gate 't < "20230805"' means…	7.53.81
9	Network Interception	high	rules.json (line 1)	The static declarativeNetRequest rules unconditionally set 'Access-Control-Allow-Origin: *' on all responses from xz.xtione.com. This CORS bypass ensures the extension's background script can always make credentialed …	7.53.81
10	Obfuscation	high	js/background.js (line 3)	Module 828 implements a custom non-standard obfuscation scheme on top of Base64: the input string is split into even/odd-indexed characters, each half is reversed, then concatenated before Base64 decoding. This is pur…	7.53.81
11	Privilege Escalation	high	js/content.js (line 175)	The content script installs a window.addEventListener('message') handler that forwards any postMessage from a web page (with from:'page') directly to chrome.runtime.sendMessage in the extension background. This create…	7.53.81
12	Tracking	high	js/background.js (line 471)	On first run, the extension generates a persistent 32-character random hex UUID stored as 'gid' in chrome.storage.local. This ID is transmitted as the 'u' parameter in every subsequent request to the C2 server (xz.xti…	7.53.81
13	Tracking	high	js/background.js (line 397)	Function O() is a tracking beacon that fires on each new day (called from y() when the daily timer expires). It transmits the persistent user UUID ('u'=n), browser identifier ('n'=r), extension version ('vp'), app num…	7.53.81

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


daneden.me	/animate	http://daneden.me/animate
opensource.org	/licenses/MIT	http://opensource.org/licenses/MIT
fonts.googleapis.com	/css	https://fonts.googleapis.com/css?family=Oswald:400,300,700
xz.xtione.com	/fortune.json	http://xz.xtione.com/fortune.json?
xz.xtione.com	/zodiac.json	http://xz.xtione.com/zodiac.json
domain.com	/path/to/somewhere/	http://domain.com:8080/path/to/somewhere/?foo=bar#hash
*	/*	http:///
*	/*	https:///
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.7 out of 5 · 6 most recent reviews

Text reviews

Positive

Negative

这款应用非常实用，提供每日星座运势、幸运色、幸运数字等信息，还能查看本周、当月和年度运势，内容详尽，极具参考价值。

JiuSam Lin·19 Jun 2024

这款应用非常实用，提供每日星座运势、��运色、幸��数字等信息，还能查看本周、当月和年度��势，内容详尽，极具参考价值。

JiuSam Lin·19 Jun 2024

这款应用非常实用，提供每日星座运势、��运色、幸运数字等信息，还能查看本周、当月和年度��势，内容详尽，极具参考价值。

JiuSam Lin·19 Jun 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

每天星座运势

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions13

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating