Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: FusioAI: Visualize AI Chat | Character.ai, Janitor.ai, Spicychat, CrushOn

CRITICAL RISKRemoved from Chrome Web Store

FusioAI: Visualize AI Chat | Character.ai, Janitor.ai, Spicychat, CrushOn

ID: maaaildnpfjnffkjifanfpjgkhdoipkg

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.0.1

Size

1.86 MB

Rating

2.0/5

Reviews

Users

135

Type

Extension

Updated

Dec 30, 2024

Publisher Contextual Analysis

Author: doublemcompany123View Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

135

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

FusioAI is AI image generator perfectly integrated with Character.ai, Janitor.ai, Spicychat, CrushOn. It will transforms your chats…

FusioAI is AI image generator perfectly integrated with Character.ai, Janitor.ai, Spicychat, CrushOn. It will transforms your chats into immersive visuals like never before. 🎨 Visualize your fantasies with real-time image generation directly from your chats—no prompt engineering needed. 🔓 Providing a safe, private space to explore your imagination without limitations. 🔥 Seamless integration with popular AI chat services like [Character.ai](http://character.ai/), JanitorAI, [SpicyChat.ai](http://spicychat.ai/), and CrushOn for effortless syncing. Whether you’re role-playing, storytelling, or diving deep into your fantasies, FusioAI ensures every moment feels real and alive. Join now and get free tokens! https://landing.fusioai.net/

User Growth

Showing data from Jan 26, 2025 to Apr 25, 2026

Versions

-10.77%(-14 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 4 ratings

Average Rating

Current: 2.25 / 5.0+2.25

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High3

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.1 Code review	9

Extension Version	Code Review Findings
1.0.1	9

Files with findings

6 distinct paths — top paths by unique finding count:

contentScriptCrawl.js3
contentScriptClient.js2
background.js1
inject.js1
manifest.json1
sidebar.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 30)	Background service worker forwards scraped chat content to a fully attacker-configurable endpoint (`server_url` is read from `chrome.storage.local`, which the page-side scripts populate from the host site's localStora…	1.0.1 1.0.1
2	Data Exfiltration	critical	contentScriptCrawl.js (line 148)	Bundles the scraped chat (messages, speaker names, conversation title, character images, full URL with chat ID) and hands it to the background service worker, which ships it off-device. Combined with the `fusio_sid` s…	1.0.1 1.0.1
3	Remote Code Loading	critical	inject.js (line 1)	This script reads a `fn` URL parameter and executes it via `new Function()` — a classic eval-equivalent dynamic code-execution sink. Because `inject.js` is exposed in `web_accessible_resources` to `<all_urls>`, ANY we…	1.0.1 1.0.1
4	Remote Code Loading	critical	contentScriptClient.js (line 27)	The page (any `fusioai.net` page, but also `localhost:8080/8081` and a hard-coded IP `http://98.84.93.176/*` listed in the manifest content_scripts) can set localStorage values that are then forwarded into `chrome.sto…	1.0.1 1.0.1
5	Unauthorized Data Collection	critical	contentScriptCrawl.js (line 162)	On janitorai.com / character.ai / spicychat.ai / crushon.ai, a `setInterval` polls every 500 ms and on every tick scrapes the user's chat conversation (texts, speakers, character title, and image URLs), then ships the…	1.0.1 1.0.1
6	Code Injection	high	contentScriptClient.js (line 1)	Injects two scripts into the page (on fusioai.net, localhost, and a hard-coded IP `98.84.93.176`) that (1) expose page localStorage to extension-listenable events and (2) monkey-patch `localStorage.setItem` to dispatc…	1.0.1 1.0.1
7	Privilege Escalation	high	manifest.json (line 38)	A production Chrome Web Store extension lists `http://localhost:8080/`, `http://localhost:8081/`, and a hard-coded plaintext public IP `http://98.84.93.176/*` as content-script match targets. Any HTTP server reachab…	1.0.1 1.0.1
8	Remote Code Loading	high	contentScriptCrawl.js (line 33)	Scraping rules (URL regex pattern + CSS selectors for messages, speakers, titles, images) are loaded from `fusio_textCrollSiteSettings` in chrome.storage.local — populated remotely via the localStorage→storage forward…	1.0.1 1.0.1
9	Obfuscation	medium	sidebar.html (line 2)	Sidebar page weakens its CSP with `'unsafe-inline'` for scripts, and the page title is `DoubleM Extension Sidebar` — a different brand from the extension name (`FusioAI`). Mismatched branding suggests the extension wa…	1.0.1 1.0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

329

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
janitorai	//.com/chats///d+$	https://janitorai\\.com/chats/\\d+$
character	//.ai/chat/[-//w	https://character\\.ai/chat/[-\\w
spicychat	//.ai/chat/[-//w	https://spicychat\\.ai/chat/[-\\w
crushon	//.ai(	https://crushon\\.ai(?:/[^/
janitorai	////.com/chats/////d+$/	https://janitorai\\\\.com/chats/\\\\d+$\
character	////.ai/chat/[-////w	https://character\\\\.ai/chat/[-\\\\w
spicychat	////.ai/chat/[-////w	https://spicychat\\\\.ai/chat/[-\\\\w
crushon	////.ai(	https://crushon\\\\.ai(?:/[^/

Showing 1 to 10 of 330 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


98.84.93.176	IPv4	-

2.7 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

owner seemingly abandoned it since the site to log in or sign up just leads to bubble.io and says "This used to be a Bubble app! The domain landing.fusioai.net is connected to a Bubble application, but the application's plan does not offer a custom domain. If you are the owner of this app, please upgrade the app plan with Bubble to restore the connection." Was this helpful?

Andy Gomez·12 Sept 2025

Can't use. I get this message when trying to log in on bubble.io: "This used to be a Bubble app! The domain landing.fusioai.net is connected to a Bubble application, but the application's plan does not offer a custom domain. If you are the owner of this app, please upgrade the app plan with Bubble to restore the connection."

LoopyLoot·15 Aug 2025

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

FusioAI: Visualize AI Chat | Character.ai, Janitor.ai, Spicychat, CrushOn

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating