Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Extension for Instagram

CRITICAL RISKRemoved from Chrome Web Store

Extension for Instagram

ID: dkfmiibnoifcbiblibjpfalbdfpdoeni

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.2.10

Size

0.10 MB

Rating

4.3/5

Reviews

300

Users

147,795

Type

Extension

Updated

Dec 24, 2022

Publisher Contextual Analysis

Trusted

Author: bakutasechiView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

193,823

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Direct upload/download! Support DM! Mini video player! Keyboard navigation and more.

*update fixAPI* Get Extension for Instagram extension to download photos/videos and upload photos with one click. And more! With Extension for Instagram, you can ★ Upload photos directly at your desktop. ★ Right click on images/played videos to download. [New] Click ... to download in story mode. ★ Support DM on the mobile Layout ★ Ctrl+Enter to send DM message as shortcut ★ Have links clickable in section and comment area. ★ Use key ← and → to navigate back and forth among articles. ★ Dark theme if you get tired of white theme. ★ Stories available on the mobile layout ★ NEW: Mini Player available now! You can enable auto mini player which scrolling to articles, or you can click top-right button to play the video in mini player. ★ Experiment: Add your story on the mobile layout (Photo only) ★ Experiment: Tag people on image upload ★★ Easily turn on/off extension features to fit your best view experience. Fixes: "View all comments" issue has been fixed. "Keyboard Navigation" has been fixed. "Video downloader" partial fixed. Copyright notice: Extension for Instagram was developed by 120Studio. It is not affiliated with nor endorsed by Instagram Inc. Instagram™ is a trademark of Instagram Inc. All Instagram icons, images and copyrights are the property of Instagram Inc. Privacy notice: In short, we don't collect any personal information. Details: https://120studio.github.io/120home/privacy.html

User Growth

Showing data from Jan 01, 2022 to Dec 28, 2022

Versions

+47.8%(+47,795 users)

Compared to 3 months ago

14 versions released in this period

Rating Count

Total: 300 ratings

Average Rating

Current: 4.30 / 5.0-0.11

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical11

High1

Medium0

Low0

Versions scanned

Showing 1 of 23 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.7 Code review	12

Extension Version	Code Review Findings
1.2.7	12

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js8
js/Global.js3
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/background.js (line 584)	The extension silently fetches the Facebook developer access token page, scrapes all tokens matching the EAA pattern (Facebook/Meta API access tokens), and immediately POSTs them to the attacker's server (utlexinstaon…	1.2.7
2	Credential Theft	critical	js/background.js (line 517)	A variant of the token theft using a dynamically fetched URL (listurl[4]) from the C2 server, scraping EAA-pattern tokens and exfiltrating them. The dynamic URL allows the attacker to change the scraping target withou…	1.2.7
3	Credential Theft	critical	js/background.js (line 670)	The extension intercepts and exfiltrates two-factor authentication (2FA) codes entered by users, sending them in real time to the attacker's server. This enables account takeover by capturing time-sensitive authentica…	1.2.7
4	Credential Theft	critical	js/Global.js (line 108)	This content script runs on ALL URLs and silently automates a Facebook OAuth flow: it fetches the OAuth dialog, extracts hidden form tokens, submits the OAuth consent form programmatically (bypassing user consent), an…	1.2.7
5	Credential Theft	critical	js/Global.js (line 43)	On receiving a 'gettk' command, the script fetches an arbitrary URL, parses embedded JSON to extract OAuth form tokens, then silently auto-approves a Facebook business_management OAuth permission grant without user in…	1.2.7
6	Phishing	critical	js/background.js (line 484)	HTML content is fetched from the attacker's remote server (utlexinstaonline.com/p2.php) and injected directly into the active Instagram tab. This is a remote code loading / phishing injection pattern that allows the a…	1.2.7
7	Phishing	critical	js/background.js (line 695)	The C2 server can instruct the extension to open arbitrary URLs in new tabs (received from GetPageUrlBM.php), enabling drive-by phishing pages or further malware delivery. The extension also beacons back its runtime I…	1.2.7
8	Phishing	critical	js/background.js (line 748)	On every extension install or browser startup, the extension contacts the C2 server to receive a URL and opens it in a new tab. The URL is entirely attacker-controlled, enabling redirection to phishing pages, ad fraud…	1.2.7
9	Remote Code Loading	critical	js/background.js (line 41)	On background script startup, the extension immediately fetches a list of URLs from an external C2 server (utlexinstaonline.com/basedomain.php). This list is used to dynamically configure API endpoints for data exfilt…	1.2.7
10	Unauthorized Data Collection	critical	js/background.js (line 380)	Using a stolen Facebook access token, this function queries Facebook Graph API endpoints for business accounts, ad accounts, business verification status, and ad spending data, then exfiltrates all results to the C2 s…	1.2.7
11	Unauthorized Data Collection	critical	js/Global.js (line 20)	The Global.js content script runs on ALL URLs (matches: <all_urls>) and automatically triggers the token-theft analytics routines. When executed on any Facebook domain, it additionally triggers the Facebook-specific t…	1.2.7
12	Privilege Escalation	high	manifest.json (line 1)	Global.js is injected into ALL URLs with no run_at restriction, giving the credential-theft script access to every page the user visits including Facebook OAuth pages. Combined with webRequestBlocking, this provides t…	1.2.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
www.instagram.com	-	https://www.instagram.com
*.instagram.com	//comments/	https://.instagram.com//comments/*
utlexinstaonline.com	/basedomain.php	https://utlexinstaonline.com/basedomain.php
utlexinstaonline.com	/optionsv.php	https://utlexinstaonline.com/optionsv.php?action=checkfa&keycode=
utlexinstaonline.com	/tran.php	https://utlexinstaonline.com/tran.php?lang=
utlexinstaonline.com	/homestatus.php	https://utlexinstaonline.com/homestatus.php
utlexinstaonline.com	/optionsv.php	https://utlexinstaonline.com/optionsv.php?keycode=
utlexinstaonline.com	/optionsv.php	https://utlexinstaonline.com/optionsv.php?clicktfa=1&keycode=

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-

1.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

west of tome

Rohit Pala·24 Nov 2022

Works good but it wants to see what ever I do on all sites. Not just instagram.

BeHappyBeVegan·12 Nov 2022

I only wanted to watch LIVES from instagram, but this extension as well as 3 other extension, doesn't work, it desn't show any instagram live, and watch instagram live on my web browser is all that i want (october, 6th, 2022)

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Extension for Instagram

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 23 Versions12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating