Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: EuroClix Clix Assistent

CRITICAL RISKRemoved from Chrome Web Store

EuroClix Clix Assistent

ID: bcmollielapcbjcpmnjhhngeldfmgpca

Could be malicious

Supported Languages

🇳🇱Dutch

Extension Info & Metadata

Status

Removed

Version

2.0.3

Size

0.49 MB

Rating

4.4/5

Reviews

Users

10,000

Type

Extension

Updated

Jun 29, 2022

Publisher Contextual Analysis

Trusted

Author: EuroClixView Profile
Privacy: Privacy Policy
Help: Help Center
Country: NL
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: Zekeringstraat 39C Amsterdam 1014BV NL

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

14,776

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Zie direct of je Clix kunt verdienen op de website die je bezoekt.

Zodra je een website bezoekt waarbij je Clix kunt verdienen wordt het icoontje van de Clix Assistent oranje. Klik vervolgens op de “Clix verdienen” knop en je spaart Clix. Zo simpel is het!

User Growth

Showing data from Jan 01, 2022 to Jan 10, 2023

Versions

No change in user count

Compared to 4 months ago

2 versions released in this period

Rating Count

Total: 29 ratings

Average Rating

Current: 4.38 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High3

Medium3

Low1

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.0.3 Code review	8

Extension Version	Code Review Findings
2.0.3	8

Files with findings

5 distinct paths — top paths by unique finding count:

lib/background.js4
debug.js1
lib/popup.js1
lib/start.js1
popup.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	lib/popup.js (line 1)	The popup fetches arbitrary HTML from a server-controlled URL (`popup_src`, set to `shopstatus.url` from the remote `/clixassistant/shopstatus/` API response) and injects it directly into `mainDiv.innerHTML` with no s…	2.0.3
2	Code Injection	high	lib/background.js (line 303)	When the server reports a matching shop (status === 2), the background service worker programmatically injects `toolbar.js` into any tab the user is on. The injected script creates a DOM overlay using server-supplied …	2.0.3
3	Remote Code Loading	high	lib/background.js (line 232)	The extension stores `shopstatus.url` (an unvalidated server-supplied value) as `popup_src` in local storage, which is then fetched and injected as raw HTML by `popup.js`. The server also controls `logo` and `cashback…	2.0.3
4	Unauthorized Data Collection	high	lib/background.js (line 128)	The background service worker listens to every tab activation and every tab URL change across the entire browser session, passing each visited URL to `bestMatch()`. Combined with the broad `http:///` and `https://*/…	2.0.3
5	Code Injection	medium	lib/start.js (line 9)	Server-supplied `shop.url`, `shop.logo`, and `shop.cashback` values from the `/clixassistant/shoplist` API are interpolated directly into an innerHTML template literal with no escaping or sanitization. A compromised o…	2.0.3
6	Network Interception	medium	lib/background.js (line 120)	A `webRequest.onBeforeRequest` listener intercepts outgoing network requests matching euroclix.nl affiliate redirect URLs and logs the full intercepted URL. While scoped to specific euroclix.nl path patterns, the `web…	2.0.3
7	Unauthorized Data Collection	medium	debug.js (line 91)	The debug page silently fetches the authenticated user's `/memberservice/editprofile` page on euroclix.nl. Although the response callback is commented out (not explicitly displayed), the request is still made with the…	2.0.3
8	Tracking	low	popup.html (line 19)	The extension popup loads a stylesheet from Google Fonts over an external CDN. Every popup open causes a third-party network request to Google's servers, leaking the user's IP address and browser fingerprint to Google…	2.0.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
www.iec.chiec	-	http://www.iec.chIEC

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Ook ik heb zelf geen vetpot en zeker geen spaarrekening dus moet het echt van de clix hebben , hiermee kan ik wel ietsje extra doen voor de kleinkinderen in de maand december

Liesbeth Geerings·17 Aug 2024

ik spaar al jaren en inderdaad ook bij mijn zijn sommige bedrijven die je aan klikt, die niet de clix uit betalen of na lange tijd bv temu en lidl wel jammer maar ja een best boven best klik systeem euroclix

miriam van de loo·22 May 2024

Je harkt niet de zilvervloot binnen, maar ik heb al verschillende keren een leuk bedrag kunnen innen in de loop der jaren. Het is gewoon in mijn dagelijkse routine geslopen, mailtjes kijken, af en toe een gokje wagen, ik vind het (nog steeds) leuk om te doen.

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

EuroClix Clix Assistent

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating