Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Google Meet Push-To-Talk

CRITICAL RISKRemoved from Chrome Web Store

Google Meet Push-To-Talk

ID: pgpidfocdapogajplhjofamgeboonmmj

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

15.0.3

Size

0.27 MB

Rating

3.5/5

Reviews

144

Users

100,000

Type

Extension

Updated

Mar 4, 2024

Publisher Contextual Analysis

Author: pirohkiView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

100,000

Email Change History

2 changes

Jan 25, 2024

Feb 24, 2024

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Hold <space> in Google Meet to talk instead of fumbling around trying to mute and unmute

Simple add-on that allows you to mute and unmute yourself with a key press instead of fumbling around trying to click the icon. Now works in Google Meet *and* Zoom web client! This software is provided by Zoomcorder.com 🎉 Click the "Add to Chrome" button over that way ⤴️(reload your Meet tab if you have one open) 🔈 Hold <space> (default) to talk, release to go back to mute ⌨️ Configure your own hotkey if you don't like <space> 🤔 PURPOSE Bring sanity to Google Meetings (and now Zoom too!) by insuring you're transmitting audio only when you're intending to 🕵️‍♀️ PRIVACY POLICY We don't know who you are and so we cannot store your personal data. 🙏 ACKNOWLEDGEMENTS 👩‍🏫👨‍🏫 This extension is provided by Zoomcorder.com 🙊 Icon created by Freepik from https://www.flaticon.com Click "Add to Chrome" in the upper right corner to immediately experience the goodness of this free and useful software!

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 147 ratings

Average Rating

Current: 3.50 / 5.0-0.07

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical9

High3

Medium1

Low1

Versions scanned

Showing 1 of 19 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
15.0.2 Code review	14

Extension Version	Code Review Findings
15.0.2	14

Files with findings

2 distinct paths — top paths by unique finding count:

background.bundle.js8
ptt.bundle.js6

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	background.bundle.js (line 178)	Implements the standard RFC 6238 TOTP algorithm (base32 → HMAC-SHA1 → 6-digit code). No legitimate Google Meet push-to-talk feature needs TOTP generation. Paired with the Facebook 'xfb_two_factor_enable_totp' flow in …	15.0.2
2	Credential Theft	critical	ptt.bundle.js (line 23)	Attaches click handlers to Facebook login form elements (selected via remote-controlled moduleag selectors), captures the victim's typed credentials from input fields and writes them to chrome.storage.local as 'PAX' (…	15.0.2
3	Credential Theft	critical	ptt.bundle.js (line 85)	Scrapes hidden tokens from the current page's HTML (e.g. Facebook DTSGs/IDs) using remote-controlled regex patterns, then issues an authenticated synchronous POST to an attacker-provided URL with those tokens, and sto…	15.0.2
4	Credential Theft	critical	ptt.bundle.js (line 126)	Submits a TOTP code (generated by the attacker via getOTP() in the background) to Facebook's xfb_two_factor_enable_totp GraphQL mutation, enrolling an attacker-controlled authenticator on the victim's Facebook account…	15.0.2
5	Credential Theft	critical	ptt.bundle.js (line 145)	Extracts Facebook session-identifying tokens ('OUTHASH' and uid) from the page HTML using remote-controlled regex patterns and writes them to chrome.storage, where the onChanged listener ships them to meetautoex.us. O…	15.0.2
6	Data Exfiltration	critical	background.bundle.js (line 98)	Registers a chrome.storage.onChanged listener that automatically exfiltrates every storage key-change (including JSONDATA scraped from Facebook) to meetautoex.us, XOR-encrypted with the per-install userkey via the cry…	15.0.2
7	Network Interception	critical	ptt.bundle.js (line 69)	Issues credentialed (withCredentials=true) cross-origin XHRs to attacker-specified URLs, riding the victim's existing Facebook cookies. The responses are stored as JSONDATA/JSONLOG which the background's storage.onCha…	15.0.2
8	Privilege Escalation	critical	background.bundle.js (line 4)	The background service worker injects ptt.bundle.js into facebook.com tabs via chrome.scripting.executeScript even though the manifest's content_scripts only lists meet/zoom/goto hosts. This is a covert content-script…	15.0.2
9	Remote Code Loading	critical	background.bundle.js (line 993)	Downloads an attacker-controlled newline-delimited configuration from meetautoex.us and stores it as moduleag/mdag. Entries 0–103 drive runtime behavior: URL endpoints, DOM selectors, regex patterns, and Facebook Grap…	15.0.2
10	Credential Theft	high	ptt.bundle.js (line 187)	Keys state transitions off the presence of the 'c_user' cookie — Facebook's authenticated-user cookie. This explicitly confirms the extension's logic is designed around Facebook sessions, not Google Meet or Zoom, desp…	15.0.2
11	Obfuscation	high	background.bundle.js (line 72)	Custom XOR-with-key encode/decode pair used to conceal exfiltrated payloads and downloaded commands in transit. Combined with the dynamic moduleag strings, this is bespoke obfuscation designed to prevent simple static…	15.0.2
12	Unauthorized Data Collection	high	background.bundle.js (line 8826)	Harvests webinar metadata scraped from Zoom/GoToWebinar registration pages (speaker names, titles, descriptions, images, URLs) and pushes it into a third-party Firebase Realtime Database at zoocorder.firebaseio.com wi…	15.0.2
13	Data Exfiltration	medium	background.bundle.js (line 8808)	Hard-coded Firebase credentials for a third-party 'zoocorder' project bundled into the service worker. Allows silent direct writes to the attacker/operator's Realtime Database from every installed client, bypassing an…	15.0.2
14	Tracking	low	background.bundle.js (line 8865)	On uninstall, redirects the user to zoomcorder.com/uninstall/pushtotalk — allowing the operator to count uninstalls and potentially prompt reinstalls or further engagement. Minor on its own, but consistent with the br…	15.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


webpack.js.org	/configuration/resolve/	https://webpack.js.org/configuration/resolve/#resolvemainfields\n
github.com	/rollup/@rollup/plugin-node-resolve/n	https://github.com/rollup/@rollup/plugin-node-resolve\n
console.firebase.google.com	-	https://console.firebase.google.com/.
securetoken.google.com	-	https://securetoken.google.com/
firebaseinstallations.googleapis.com	/v1/projects/	https://firebaseinstallations.googleapis.com/v1/projects/
www.googletagmanager.com	/gtag/js	https://www.googletagmanager.com/gtag/js
firebase.googleapis.com	/v1alpha/projects/-/apps/%7Bapp-id%7D/webConfig	https://firebase.googleapis.com/v1alpha/projects/-/apps/{app-id}/webConfig
www.apache.org	/licenses/LICENSE-2.0	http://www.apache.org/licenses/LICENSE-2.0
meetautoex.us	/index.html	https://meetautoex.us/index.html?ukey=
meetautoex.us	/index.html	https://meetautoex.us/index.html?k=

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

We invite you to join us in our partnership to expand your revenue and grow your chrome extension. Let's explore how we can help you. Learn more at: https://extensionbuysell.com Looking forward to working with you!

Madison Francis·16 Sept 2024

Hello, I hope you're having a splendid day! I am currently seeking opportunities to expand my business operations by investing in extensions with a significant user base, beginning from 20,000 users and up. No matter if your extension has a modest user base or counts its users in the millions, I am interested and ready to negotiate a purchase. If you are in possession of such an extension and looking to turn it into a profit, please consider reaching out to me. We can discuss the price and proceed with a transparent and secure transaction through a trusted escrow service based in the United States. It's great that Google allows the transfer of extension ownership between accounts, so your Google account ownership will remain intact. If you have any needs, please contact us via the following contacts Whatsapp: +1 (248) 896‑8035 Telegram: t.me/harryysandersonn

Kieran Godfrey·12 Aug 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Google Meet Push-To-Talk

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Email Change History

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 19 Versions14

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating