Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Enjoy media

CRITICAL RISKRemoved from Chrome Web Store

Enjoy media

ID: emppemggbdnnfpahnmmifnfmlonnifon

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

0.0.2

Size

0.11 MB

Rating

5.0/5

Reviews

Users

6,000

Type

Extension

Updated

Mar 27, 2022

Publisher Contextual Analysis

Author: Andrey SokolchikView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

6,011

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Find your favorite videos in popular open sources and download them easily with our extension. Enjoy media will show a list of…

Find your favorite videos in popular open sources and download them easily with our extension. Enjoy media will show a list of available files in the extension menu. Just click the "Download" button and the files will be saved to your computer in a few seconds with the same quality.

User Growth

Showing data from Mar 17, 2022 to Apr 22, 2022

Versions

No change in user count

Compared to 1 month ago

2 versions released in this period

Rating Count

Total: 24 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High3

Medium2

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.1 Code review	10

Extension Version	Code Review Findings
0.0.1	10

Files with findings

6 distinct paths — top paths by unique finding count:

background_js/root.js4
background_js/tasks.js2
background.js1
js/background_js/download.js1
js/content_js/providers/fb.js1
js/content_js/providers/inst.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background_js/tasks.js (line 127)	The C2 server response handler accepts a remote `url` command and either silently redirects an existing browser tab or creates a new hidden, muted tab navigated to the operator-specified URL. This is a classic adware/…	0.0.1
2	Credential Theft	critical	js/content_js/providers/fb.js (line 3)	When the user visits Facebook, this content script extracts the user's Facebook session authentication token (`async_get_token` / `fb_dtsg_ag`) and User ID directly from inline page scripts by DOM scraping. These are …	0.0.1
3	Data Exfiltration	critical	background_js/root.js (line 269)	On first install, the extension phones home to the hardcoded C2 server `https://tabinfo.site` (stored as `defaultClickDomain`) with a detailed browser fingerprint including `user_agent`, timezone offset, accepted `lan…	0.0.1
4	Obfuscation	critical	background.js (line 1)	The entire extension codebase is heavily obfuscated by embedding hundreds of meaningless random string literals, boolean values (!0), and floating-point numbers interspersed throughout real executable statements. This…	0.0.1
5	Unauthorized Data Collection	critical	background_js/tasks.js (line 77)	Triggered every minute by a `chrome.alarms` ticker, `fetchTasks` retrieves all open browser tabs via `chrome.tabs.query({})` — including their full URLs and metadata — and POSTs the complete tab array to the remote C2…	0.0.1
6	Privilege Escalation	high	background_js/root.js (line 31)	Immediately upon installation, the extension iterates over every currently open browser tab and injects `tubes.js` via `chrome.scripting.executeScript` — regardless of the tab's URL — bypassing the declared content sc…	0.0.1
7	Tracking	high	background_js/root.js (line 94)	A persistent telemetry beacon sends structured metrics (context, event type, event name, value) to `https://tabinfo.site/v2/metric` with each request including the user's `uuid` and `installParams` via `getParams()`. …	0.0.1
8	Unauthorized Data Collection	high	background_js/root.js (line 315)	The `getInstallParams` function reads all cookies from the `tds.tabinfo.site` domain using `chrome.cookies.getAll()` and encodes them into the install event parameters transmitted to the C2 server. This allows the aff…	0.0.1
9	Network Interception	medium	js/background_js/download.js (line 453)	The `deep-frame` message handler fetches an arbitrary remote URL provided by content scripts and performs regex extraction of media URLs from the response body. This acts as a CORS proxy for the content scripts, allow…	0.0.1
10	Unauthorized Data Collection	medium	js/content_js/providers/inst.js (line 138)	This content script runs on Instagram pages and uses the user's active authenticated session (cookies are sent automatically by the browser) to make calls to Instagram's private JSON API endpoint (`?__a=1`), extractin…	0.0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	-	https://*
*	-	http://*
http:	-	http://:
https:	-	https://:
tabinfo.site	-	https://tabinfo.site
chrome.google.com	/webstore	https://chrome.google.com/webstore
www.facebook.com	/video/video_data_async/	https://www.facebook.com/video/video_data_async/?video_id=${id}&fb_dtsg_ag=${token}&__user=${userId}&__a=1`;
www.instagram.com${a}`;	-	https://www.instagram.com${a}`;
vk.com	/al_video.php	https://vk.com/al_video.php?act=show_inline&al=1&video=${id}`;

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Pleases the eye with beautiful purple images. Who wants to decorate their browser, I advise you to install.

Vladimir Kuznetsov·17 Mar 2022

This extension perfectly finds various videos on the site and makes it possible to download them at high speed!

�Н

��онс��ант��н Новиков·17 Mar 2022

Cool and very convenient application. I watched a video on the website and thought about how to download it. Found this extension. Downloaded in two mouse clicks. Thanks to the developers!

wima opgy·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Enjoy media

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews