Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Everliker Standalone | Social Assistant

CRITICAL RISKRemoved from Chrome Web Store

Everliker Standalone | Social Assistant

ID: ilopacefbnegkpdgphfpgdnjpkggognj

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

3.3

Size

0.31 MB

Rating

4.2/5

Reviews

109

Users

6,424

Type

Extension

Updated

Mar 15, 2023

Publisher Contextual Analysis

Author: rainermaucknerView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

6,497

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Smart and Simple Assistant for Instagram(tm)

LET EVERLIKER TO LIKE INSTAGRAM PHOTOS AND VIEW STORIES: * Everliker is a little app that saves time and brings attention to your Instagram account by liking posts on your behalf. * Anyone and any business can use Everliker to free up time and get more followers and likes on Instagram. SECURE: * Doesn’t need your Instagram username or password to operate. * Doesn’t send your Instagram activity to a remote server. Your data is secure. * Works from your local IP address and is designed for personal use. EASY TO USE: * It takes less than 1 minute to set up. SMART * Everliker is intelligent. You can configure speed to your liking. * Your account keeps growing while you focus on important things. Disclaimer: this Chrome plugin is an independent project and is not endorsed or certified by Instagram. All Instagram logos and trademarks displayed on this Chrome plugin are property of third parties. Everliker is distributed AS IS. You use this extension at your own risk.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-1.28%(-83 users)

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 103 ratings

Average Rating

Current: 4.38 / 5.0-0.10

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High2

Medium2

Low0

Versions scanned

Showing 1 of 9 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2 Code review	9

Extension Version	Code Review Findings
2	9

Files with findings

2 distinct paths — top paths by unique finding count:

background.js8
404.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 554)	Classic affiliate-commission hijacking. When the user visits a Booking.com URL that already contains an 'aid=' affiliate ID (some other partner's referral) and a 'label=' tracker, the code rewrites both: it strips the…	2
2	Network Interception	critical	background.js (line 433)	A global tabs.onUpdated listener fires verifyLink() on every loading navigation in any tab (not scoped to instagram.com despite the manifest only declaring instagram host_permissions — chrome.tabs.update works on any …	2
3	Network Interception	critical	background.js (line 526)	verifyLink contains a hard-coded ladder for major affiliate merchants (Aliexpress, Booking, Bluehost, Adobe, Hotels), each branch doing chrome.tabs.update on the user's tab to a redirector URL like _oR + 'abs' + rand(…	2
4	Remote Code Loading	critical	background.js (line 464)	The 'license' check fetches https://www.ever-liker.com/license_verification and pulls down a remote JSON config containing 'settings', 'license', and 'ig' fields. The 'settings' string is parsed by checkLic() into the…	2
5	Remote Code Loading	critical	background.js (line 634)	checkLic parses the server-supplied 'settings' string into a list of redirect-rule objects (with fields like p, r, e, i, ll, pr) that are stored in lAL and consulted on every tab navigation. The format is a hand-rolle…	2
6	Obfuscation	high	background.js (line 297)	The redirector base URL ('https://prj2.../', '.com', 'www.') and the merchant target keywords used in verifyLink (Aliexpress 'cHJvZHVj...', Booking, Adobe Stock 'Y3JlYXRpdmVjbG91ZC...', Hotels.com 'aG90ZWxz', etc.) ar…	2
7	Obfuscation	high	background.js (line 684)	The 'licenseVerification' string returned by the server is consumed positionally — each rule in lAL declares a length 'p' and the matching domain is read by slicing licenseVerification[lastValue : lastValue+p] and bas…	2
8	Network Interception	medium	404.js (line 1)	404.js is a recovery script that, on the Instagram tab, force-replaces window.location with a URL drawn from chrome.storage. While this is part of the Instagram-automation flow on its face, it is the same primitive (s…	2
9	Unauthorized Data Collection	medium	background.js (line 9)	The extension uses chrome.scripting.executeScript to inject jQuery + a 3,375-line contentscript.js into Instagram pages on user click, and viewstories.js automates clicking follow buttons (.zwlfE...button.jIbKX) and c…	2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


youtu.be	/69oSbMGIeTQ	https://youtu.be/69oSbMGIeTQ
www.instagram.com	/explore/tags/	https://www.instagram.com/explore/tags/
www.instagram.com	/explore/locations/	https://www.instagram.com/explore/locations/
www.instagram.com	-	https://www.instagram.com
www.instagram.com	-	https://www.instagram.com/
www.invitelikecomment.com	-	https://www.invitelikecomment.com/
chrome.google.com	/webstore/detail/	https://chrome.google.com/webstore/detail/
www.facebook.com	/sharer/sharer.php	https://www.facebook.com/sharer/sharer.php?u=https://chrome.google.com/webstore/detail/
www.instagram.com	/explore/tags/cinqueterre/	https://www.instagram.com/explore/tags/cinqueterre/
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Not wroking now

Raj Kuwajerwala·20 May 2023

Is no longer working, tried on multiple computers it had previously worked on.

Jack Gregory·19 Mar 2023

amazing, just fix the stories part. stories doesnt work

Khalid Jak·20 Jan 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Everliker Standalone | Social Assistant

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 9 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating