Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: FastProxy

CRITICAL RISKRemoved from Chrome Web Store

FastProxy

ID: gjaojbkkfpedgefidkagjeibcbfnakke

Could be malicious

Supported Languages

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

1.0.3

Size

0.16 MB

Rating

1.0/5

Reviews

Users

400,000

Type

Extension

Updated

Mar 16, 2022

Publisher Contextual Analysis

Trusted

Author: strakhov.alexView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

400,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

FastProxy — это надежный и удобный VPN-клиент, который обеспечит вам полноценный доступ ко всем ресурсам в интернете, включая те,…

FastProxy — это надежный и удобный VPN-клиент, который обеспечит вам полноценный доступ ко всем ресурсам в интернете, включая те, что недоступны в вашем регионе. После установки расширения в браузере Google Chrome, вы можете сразу пользоваться всеми преимуществами прокси-сервера. Настройка системы происходит автоматически и не требует никакого участия пользователя— благодаря этому пользоваться FastProxy просто и удобно. Сервис предлагает два тарифных плана с гарантированно высокой скоростью: Обычный — 199 руб/мес Премиальный — 499 руб/мес В премиум-тарифе вы дополнительно получите приоритетную поддержку и индивидуальный прокси. Мы предлагаем лучшую скорость за небольшие деньги, стабильный доступ и гарантируем возврат денег, если вас не устроит качество соединения.

User Growth

Showing data from Jan 01, 2022 to Jun 16, 2022

Versions

+900%(+360,000 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 10 ratings

Average Rating

Current: 1.00 / 5.0+1.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High7

Medium2

Low0

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.2 Code review	4
1.0.0 Code review	9

Extension Version	Code Review Findings
1.0.2	4
1.0.0	9

Files with findings

4 distinct paths — top paths by unique finding count:

bg.js6
page.js4
popup.js2
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	page.js (line 172)	The content script defines executeScript() which creates a <script> element and injects arbitrary JavaScript strings directly into the host page's DOM, running them in the page's own execution context rather than the …	1.0.0
2	Network Interception	critical	bg.js (line 295)	The background script sends extension and client state to a remote API and fully trusts the response to configure Chrome's proxy settings. This gives `api.fastproxy.app` server-side control over where the user's brows…	1.0.2
3	Network Interception	critical	bg.js (line 201)	The extension POSTs the user's unique client ID, extension runtime ID, name, version, and proxy status to a remote server (api.fastproxy.app/v2/config) on every startup. The server response then fully controls the pro…	1.0.0
4	Privilege Escalation	critical	popup.js (line 233)	The extension can forcibly disable any other installed extension that declares the proxy permission using chrome.management.setEnabled(manager.id, false). This is an active privilege escalation attack: the extension n…	1.0.0
5	Code Injection	high	page.js (line 196)	The content script serializes the ProxyDialogBox class definition via .toString() and injects it as a raw script string into every non-excluded webpage visited while proxy is active. Injecting class definitions via ex…	1.0.0
6	Code Injection	high	manifest.json (line 37)	The manifest explicitly enables 'unsafe-eval' in the extension's Content Security Policy, permitting dynamic code execution via eval(), Function(), and setTimeout(string). While not currently used in visible code, thi…	1.0.0
7	Data Exfiltration	high	bg.js (line 8)	When the 'check' flag is enabled in the extension's remote-controlled storage, the webRequest error handler beacons the full URL of any failed request (matching net::ERR_TUNNEL_CONNECTION_FAILED) to fastproxy.app/repo…	1.0.0
8	Network Interception	high	bg.js (line 375)	The extension hooks `webRequest.onAuthRequired` and silently injects stored proxy credentials into authentication challenges. Combined with the remotely supplied proxy configuration, this allows the operator to push a…	1.0.2
9	Privilege Escalation	high	popup.js (line 328)	This code enumerates installed extensions and disables any enabled extension that has the `proxy` permission. That is an aggressive use of `management` privilege to suppress other extensions rather than just warning t…	1.0.2
10	Unauthorized Data Collection	high	bg.js (line 228)	The extension registers configure() — which sends telemetry to the C2 server — as a listener on every extension lifecycle event (install, uninstall, enable, disable) for all extensions in the browser. This means every…	1.0.0
11	Unauthorized Data Collection	high	bg.js (line 49)	The extension uses chrome.management.getAll() to enumerate all installed extensions and inspect their declared permissions, looking specifically for competing proxy-capable extensions. This enumeration result feeds in…	1.0.0
12	Code Injection	medium	page.js (line 319)	The content script constructs executable code with `Function(n)` and runs it if a runtime message callback supplies a string. This is a classic dynamic-code-execution primitive, and in an extension that already reques…	1.0.2
13	Tracking	medium	page.js (line 217)	The content script reads and writes to the localStorage of every website visited by the user (using key fastProxyFirstTimeDialogKey) to track dialog display timing across sessions. Writing to a site's localStorage pol…	1.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
reactjs.org	/link/react-polyfills	https://reactjs.org/link/react-polyfills
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace
animate.style	-	https://animate.style/
opensource.org	/licenses/MIT	http://opensource.org/licenses/MIT
getbootstrap.com	-	https://getbootstrap.com/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Тормозит хро��

РН

Рома Ники��оров·7 Jun 2022

Тормозит хром

РН

Рома Никифоров·7 Jun 2022

Не работает.

АК

Андрей Корнеев·3 Jun 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

FastProxy

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions13

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews