| 1 | Code Injection | critical | js/contentScript.js (line 1) | The content script injects a raw `<script>` tag containing code received from the remote C2 server (xapi.bntyh.com) directly into matched web pages. The injected script field is entirely server-controlled and can be c… | |
| 2 | Remote Code Loading | critical | js/contentScript.js (line 4034) | The content script accepts a server-supplied object, posts page metadata to arbitrary `ext_url` endpoints, then injects server-provided HTML/CSS into matched DOM nodes and executes `f.script` via `evil(...)`. Because … | |
| 3 | Remote Code Loading | critical | js/utils.js (line 1) | The getServerUrls function POSTs to xapi.bntyh.com/version with Base64-obfuscated payload containing the current URL-config version, geographic area, IP address, and timestamp. The server responds with a dynamically-u… | |
| 4 | Unauthorized Data Collection | critical | js/utils.js (line 1) | The global BANGNINTAO object hardcodes multiple tracking infrastructure endpoints including a primary API server (xapi.bntyh.com), a secondary IP-lookup server (api.yhchj.com), an analytics pixel host (sr.anhuiry.com)… | |
| 5 | Unauthorized Data Collection | critical | js/utils.js (line 1) | The yhc_get_uuid function first fetches the user's real IP address from api.yhchj.com/ip, then combines it with a full Fingerprint2 browser fingerprint (canvas, WebGL, plugins, screen info, user-agent) to generate a p… | |
| 6 | Data Exfiltration | high | js/contentScript.js (line 3931) | Before requesting new remote instructions, the content script reads all extension local storage, extracts keys matching `ad_<eid>_content`, and sends the collected values to the backend with the persistent UUID and ve… | |
| 7 | Data Exfiltration | high | js/utils.js (line 1) | The fp2Log function silently exfiltrates tracking data by loading a 1x1 tracking pixel (sp.gif) via a hidden Image object. It appends all event parameters (tid, uuid, eid, cid, timestamp) plus stored 'otherkey' data (… | |
| 8 | Data Exfiltration | high | js/contentScript.js (line 1) | On product and coupon pages, the content script POSTs the page title, full current URL, product ID, extension version, and browser type to server-controlled endpoints (ext_url.product and ext_url.coupon) sourced from … | |
| 9 | Data Exfiltration | high | js/background.js (line 1) | The background script fires a tracking beacon on install (tid=1) and registers an uninstall URL, both carrying extension version and browser fingerprint ID. More critically, it listens for any GET/POST messages from c… | |
| 10 | Remote Code Loading | high | js/contentScript.js (line 1) | The content script retrieves a server-provided domain_list and URL map, then checks if the current page's origin matches any entry in the remote list. This allows the C2 server to remotely expand the set of websites w… | |
| 11 | Tracking | high | background.js (line 4225) | The background worker generates a persistent identifier by combining a Fingerprint2 browser/device fingerprint with the user's externally fetched IP address, then stores it as `uuid`. This is a strong cross-session tr… | |
| 12 | Obfuscation | medium | js/utils.js (line 1) | The extension uses a custom obfuscation scheme wrapping Base64 with random 2-character prefix and suffix before transmission to the C2 server, making the outbound payload harder to inspect in network traffic analysis.… | |
| 13 | Other | medium | background.js (line 4022) | The extension phones home to `/version` with the stored UUID and prior area/IP data, then persists the server response as `urls`, which later drives which domains and paths the all-sites content script will modify. Th… | |
