Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Fnet - Доступ к сайтам!

CRITICAL RISKRemoved from Chrome Web Store

Fnet - Доступ к сайтам!

ID: ichhfdldoddmimpajkijflgkifkgeffg

Could be malicious

Supported Languages

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

31.30

Size

0.87 MB

Rating

0.0/5

Reviews

Users

500,000

Type

Extension

Updated

Jan 19, 2024

Publisher Contextual Analysis

Author: pavelkuranenkoView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

500,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Доступ к вашим любимым сайтам!

Fnet: Доступ к вашим любимым сайтам! Если у вас есть какие-либо технические проблемы, пожалуйста, напишите нам по адресу [email protected] Fnet требует следующих разрешений: - Proxy: расширение Fnet проксирует ваш трафик через сервер в другой страна, чтобы изменить свой IP и разблокировать ограниченные сайты. - AllHosts / WebRequest / WebRequestBlocking: позволить расширению Fnet проверять каждый веб-запрос и изменять его.. - Tabs: Fnet отслеживает ваши вкладки и включает VPN только на определенных вкладках и показывает всплывающее окно на странице, чтобы позволить вам включать, отключать и исправлять проблемы с подключением. - Cookies: Fnet получит доступ к вашим куки. Некоторые сайты кэшируют вашу страну в файлах cookie, и необходимо очистить их, прежде чем вы сможете получить доступ к этому сайту из другой страны. - Stroge: Fnet хранит локальную конфигурацию и данные кеша.

User Growth

Showing data from Jan 19, 2024 to Mar 07, 2024

Versions

No change in user count

Compared to 2 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical6

High3

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
31.30 Code review	11

Extension Version	Code Review Findings
31.30	11

Files with findings

3 distinct paths — top paths by unique finding count:

main/scripts/background.js9
main/scripts/content.bund.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	main/scripts/background.js (line 1)	When the extension activates a cashback session on a merchant site it: (1) reads all cookies for that domain via `chrome.cookies.getAll`, (2) injects a script into the merchant tab to selectively wipe localStorage and…	31.30
2	Data Exfiltration	critical	main/scripts/background.js (line 1)	For every merchant site visit the extension silently POSTs an affiliate 'transaction' to `https://thewallett.com/api/transaction/create` carrying the user's extension ID, affiliate program ID, merchant ID, and activat…	31.30
3	Network Interception	critical	main/scripts/background.js (line 1)	The extension installs two persistent declarativeNetRequest rules: rule 88 silently blocks all network requests (including page navigations) that contain competitor affiliate tracking parameters `t_tid=` or `t_s=`…	31.30
4	Network Interception	critical	main/scripts/background.js (line 1)	The `blockTrackers()` method fetches a list of domains from `thewallett.com/api/configs/blockingDomains` and creates a DNR blocking rule for each one, covering all resource types including main_frame navigations. The …	31.30
5	Privilege Escalation	critical	main/scripts/background.js (line 1)	The extension downloads a server-controlled list of extension IDs (`disableExtList` / `dEtList`) from thewallett.com and silently calls `chrome.management.setEnabled(id, false)` on each one at startup. This gives the …	31.30
6	Unauthorized Data Collection	critical	main/scripts/background.js (line 1)	On installation (and whenever analytics are re-enabled) the extension enumerates every installed Chrome extension with `chrome.management.getAll` and transmits all their IDs as a JSON array to the analytics server. Th…	31.30
7	Data Exfiltration	high	main/scripts/background.js (line 1)	When a user navigates to a merchant site, the extension silently redirects the tab to the operator's affiliate click URL (`sCashback.baseClick`) with the merchant ID, partner ID, and the user's original URL as paramet…	31.30
8	Tracking	high	main/scripts/background.js (line 1)	Every analytics event is augmented with OS, browser type, language, `extension_id`, and `extension_version` before being sent to `analytics.savematik.com`. A secondary POST goes to `analytics.besttoolbars.net/api/v1/a…	31.30
9	Tracking	high	main/scripts/background.js (line 1)	The extension maintains a persistent authenticated session with thewallett.com using JWT access/refresh tokens stored in `chrome.storage.local`, sending `Extension-ID` and `Extension-Version` headers on all requests. …	31.30
10	Code Injection	medium	main/scripts/content.bund.js (line 1)	The content script runs on every page (`<all_urls>`) and unconditionally injects a `<g-ext-in>` sentinel element into the DOM, plus responds to background messages to prepend `div#ext-ah-install` and `div#ext-ah-proxy…	31.30
11	Other	medium	manifest.json (line 26)	`externally_connectable` allows any page on `fnet-vpn.ru` to send messages directly into the extension's runtime, giving the operator's website the ability to trigger extension actions programmatically from the browse…	31.30

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fontello.commaterial	-	http://fontello.comMaterial
www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
fonts.googleapis.com	/icon	https://fonts.googleapis.com/icon?family=Material+Icons
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
npms.io	/search	https://npms.io/search?q=ponyfill.
analytics.savematik.com	-	https://analytics.savematik.com
pingapi.	-	https://pingapi.
chrome.google.com	/webstore/detail/	https://chrome.google.com/webstore/detail/
tinyurl.com	/y2uuvskb	https://tinyurl.com/y2uuvskb

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


26.141.185.3	IPv4	-
3.135.246.134	IPv4	-
2.1.218.176	IPv4	-
158.131.243.243	IPv4	-

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Fnet - Доступ к сайтам!

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating