Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: EagleGet Free Downloader

CRITICAL RISKRemoved from Chrome Web Store

EagleGet Free Downloader

ID: kaebhgioafceeldhgjmendlfhbfjefmo

Could be malicious

Extension Info & Metadata

Status

Removed

Version

2.2.80

Size

0.10 MB

Rating

4.5/5

Reviews

5,858

Users

709,803

Type

Extension

Updated

May 14, 2020

Publisher Contextual Analysis

Author: http://www.eagleget.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

709,803

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Download files with Eagleget

EagleGet is a free all-in-one download manager and accelerator. The EagleGet Downloader extension for Google Chrome could take over and accelerate the downloads from your Chrome browser. The software application is multilingual and works on Windows 10, 8/8.1, 7, Vista and XP. No error dialogs were displayed in our tests, and the tool didn't hang or crash. It offers support for HTTP, HTTPS, FTP, MMS and RTSP. With the help of this app you can download various files from the Internet and integrate it into Internet Explorer, Google Chrome, Mozilla Firefox and Opera. It offers support for multiple threads that aid it in speeding up tasks, along with automatic, manual and batch downloads. Additionally, EagleGet contains Clipboard and browsing live monitoring tools, MD5 and SHA1 checksum verifiers, pending queue with scheduled tasks that can be organized into different folders by type, automatic post-task actions and virus checkups, gaming mode (with all notifications disabled), together with a task cleaner, etc. v2.2.28 fixed cannot sniffer on chrome beta.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical6

High6

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.2.80 Code review	14

Extension Version	Code Review Findings
2.2.80	14

Files with findings

3 distinct paths — top paths by unique finding count:

background.js8
js/contentscript.js5
background.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/contentscript.js (line 205)	When the background page sends a message with `name == 'whitelist'` and a `content` string, the content script dynamically creates a `<script>` element, sets its `textContent` to the message content, and appends it to…	2.2.80
2	Credential Theft	critical	background.js (line 1)	The `onBeforeRequestCallback` intercepts all POST request bodies across all URLs and reassembles form field key-value pairs into a URL-encoded `postData` string stored in the request state. This captures login credent…	2.2.80
3	Data Exfiltration	critical	background.js (line 1)	The `invokeEG` function bundles URL, full cookie string, referrer, user-agent, all captured request headers (including `x-client-data`), POST body data, content-type, and file metadata, then transmits it to the native…	2.2.80
4	Network Interception	critical	background.js (line 1)	The extension registers blocking listeners on all three webRequest interception points (`onHeadersReceived`, `onBeforeSendHeaders`, `onBeforeRequest`) for `<all_urls>` — every HTTP and HTTPS request made by the browse…	2.2.80
5	Unauthorized Data Collection	critical	background.js (line 1)	For every outbound request across all URLs, `onBeforeSendHeadersCallback` systematically harvests cookies, referer, user-agent, content-type, all other request headers, and specifically the `x-client-data` header (Goo…	2.2.80
6	Unauthorized Data Collection	critical	background.js (line 1)	The response header callback harvests `set-cookie` response headers (accumulating all cookies from a domain), content-disposition, content-length, content-type, and location redirect headers from every HTTP response. …	2.2.80
7	Credential Theft	high	background.js (line 1)	The `getCookies` helper uses `chrome.cookies.get` to programmatically retrieve named cookies for arbitrary URLs. With the `cookies` permission and broad host access (`http:///`, `https:///`), this can retrieve ses…	2.2.80
8	Credential Theft	high	js/contentscript.js (line 6)	The `downloadOne` function in the content script reads `document.cookie` (all cookies accessible on the current page) and passes them — along with the link URL, referrer, and any POST data — to the background via `chr…	2.2.80
9	Credential Theft	high	js/contentscript.js (line 35)	The `downloadAll` function bundles all page cookies (via `document.cookie`) together with every link, image source, and `<param>` value found on the page into a pipe-delimited string and sends it to the background. Th…	2.2.80
10	Network Interception	high	background.js (line 1)	The extension opens a WebSocket connection to localhost on ports 32768–32772, scanning sequentially on error. This establishes a persistent bidirectional channel with a locally running process, ostensibly to retrieve …	2.2.80
11	Obfuscation	high	background.js (line 1)	The entire background script encodes all string literals into a single `_$` array (200+ entries), including API names, URLs, header names, cookie fields, and native messaging commands. This obfuscation technique is sp…	2.2.80
12	Privilege Escalation	high	background.html (line 1)	The background page embeds two hidden NPAPI plugin objects (`application/x-eagleget` and `application/x-eagleget64`). NPAPI plugins run as native code with full OS-level privileges and no Chrome sandbox. While NPAPI w…	2.2.80
13	Code Injection	medium	js/contentscript.js (line 249)	On Baidu Cloud Disk pages (pan.baidu.com, yun.baidu.com, eyun.baidu.com), the extension injects a script that overrides `navigator.platform` via `Object.defineProperty` to return the string `'eg'` (EagleGet fingerprin…	2.2.80
14	Unauthorized Data Collection	medium	js/contentscript.js (line 236)	A global keyboard event listener is injected into every page visited (`document_start`, all frames). It monitors for Ctrl+Alt key combinations and sends these events to the background script. While ostensibly disablin…	2.2.80

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


*	/*	http:///
*	/*	https:///
www.eagleget.com	/eagleget-extension-uninstalled-successfully/	http://www.eagleget.com/eagleget-extension-uninstalled-successfully/?type=chrome&v=
www.eagleget.com	/eagleget-extension-installed-successfully/	http://www.eagleget.com/eagleget-extension-installed-successfully/?type=chrome&v=
jquery.com	-	http://jquery.com/
jquery.org	/license	http://jquery.org/license
sizzlejs.com	-	http://sizzlejs.com/
www.eagleget.com	/thank-you/	http://www.eagleget.com/thank-you/
www.eagleget.com	/download/setup.exe	http://www.eagleget.com/download/setup.exe
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Not work new.

Chanuka Dilshan·6 Nov 2020

Media grabber shows the 'unknown error occured' message every time.

Jayant Verma·4 Nov 2020

Even when i have already disabled the extension, it still sniffs videos and overrides downloads intended for browser download, please fix this. The browser is edge (or maybe there is a setting somewhere which solves this problem )

Hououin Kyouma

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

EagleGet Free Downloader

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version14

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews