Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: iMacros for Chrome

CRITICAL RISKRemoved from Chrome Web Store

iMacros for Chrome

ID: cplklnmnlbnpmjogncfgfijoopmnlemp

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

10.1.1

Size

0.52 MB

Rating

3.4/5

Reviews

2,279

Users

400,000

Type

Extension

Updated

Dec 3, 2023

Publisher Contextual Analysis

Trusted

Author: iMacros (A Progress Software Product)View Profile
Privacy: Privacy Policy
Help: Help Center
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 15 Wayside Road, Suite 400 Burlington, MA 01803 US

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

400,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Automate your web browser. Record and replay repetitious work

Version 10.1.1 is a branding update ⚑ iMacros is part of the Progress Software Corporation product portfolio (progress.com/products) iMacros is designed to automate the most repetitious tasks on the web. If there’s an activity you have to do repeatedly, just record it in iMacros. The next time you need to do it, the entire macro will run at the click of a button! With iMacros, you can quickly and easily fill out web forms, remember passwords, create a web mail notifier, and more. You can keep the macros on your computer for your own use, use them within bookmark sync, or share them with others by embedding them on your homepage, blog, company intranet or any social bookmarking service. The uses are limited only by your imagination! Popular uses are as web macro recorder, form filler on steroids and highly-secure password manager (256-bit encryption). Web developers use iMacros for web regression testing, performance testing and web transaction monitoring. It can also be combined with Google Speed Tracer, Firebug and other web development and test tools. XPath and CSS selector support is included. iMacros can be combined with Greasemonkey style content scripts and the macros can be started via the command line e. g. via the Windows task scheduler, batch files or a Linux cron job. You can combine iMacros with popular ad-blocking extensions to further speed up your web automation tasks. Macros recorded with iMacros for Chrome are compatible with other versions of iMacros. All iMacros versions combined have millions of active users, making it the most popular web browser automation tool. For more information please visit: https://wiki.imacros.net/iMacros_for_Chrome If you encounter any problems with iMacros for Chrome, please let us know in our Chrome user forum: https://forum.imacros.net/viewforum.php?f=21 Our forum is also the best place for new feature suggestions.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 2,271 ratings

Average Rating

Current: 3.40 / 5.0-0.04

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High13

Medium4

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
10.1.1 Code review	7
10.1.0 Code review	11

Extension Version	Code Review Findings
10.1.1	7
10.1.0	11

Files with findings

7 distinct paths — top paths by unique finding count:

mplayer.js8
AsyncFileIO.js2
content_scripts/recorder.js2
nm_connector.js2
sandbox.js2
content_scripts/bookmarks_handler.js1
utils.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	critical	mplayer.js (line 730)	The extension attaches the Chrome Debugger protocol to browser tabs and sends arbitrary Chrome DevTools Protocol (CDP) commands via `chrome.debugger.sendCommand()`. When a debugger is attached to a tab, the extension …	10.1.0
2	Code Injection	high	sandbox.js (line 16)	This sandbox page evaluates attacker-controlled JavaScript received via postMessage. Because the extension later posts expressions into this page, any path that influences `event.data.expression` becomes arbitrary cod…	10.1.1
3	Code Injection	high	mplayer.js (line 3129)	The macro engine treats `javascript:` URLs as code and injects them directly into the active tab with `chrome.tabs.executeScript`. This gives macro content a built-in path to run arbitrary script on visited pages, whi…	10.1.1
4	Code Injection	high	sandbox.js (line 16)	The sandbox page listens for `postMessage` events of type `eval_in_sandbox` and calls `eval()` directly on `event.data.expression` without any origin validation or content sanitization. While Chrome's sandbox CSP prov…	10.1.0
5	Credential Theft	high	mplayer.js (line 1797)	This code decrypts stored credentials and installs a blocking `webRequest.onAuthRequired` handler for `<all_urls>`. That gives the extension the ability to intercept HTTP auth challenges across sites and programmatica…	10.1.1
6	Credential Theft	high	mplayer.js (line 1685)	The `onlogin` macro command registers a blocking `webRequest.onAuthRequired` listener that covers `<all_urls>` and intercepts HTTP authentication challenges across all websites. The plaintext credentials (after Rijnda…	10.1.0
7	Credential Theft	high	content_scripts/recorder.js (line 986)	When the recorder is active, it captures every keypress event on all pages, including characters typed into `<input type="password">` fields. Each character is captured individually (`String.fromCharCode(event.which)`…	10.1.0
8	Credential Theft	high	content_scripts/recorder.js (line 421)	In addition to keystroke capture, when a form with a password field is submitted or the field loses focus, the full password value (`elem.value`) is extracted and included in the recorded macro action. This captures t…	10.1.0
9	Network Interception	high	mplayer.js (line 1964)	The macro language can reconfigure Chrome to use an arbitrary fixed proxy server. A malicious macro could silently route browser traffic through attacker infrastructure for interception, traffic manipulation, or sessi…	10.1.1
10	Network Interception	high	mplayer.js (line 2471)	The `SET !USERAGENT` macro command registers a `webRequest.onBeforeSendHeaders` listener in `blocking` mode with full `requestHeaders` access on `<all_urls>`. This gives the extension the ability to intercept and modi…	10.1.0
11	Network Interception	high	mplayer.js (line 1835)	The `PROXY` macro command can set the browser's proxy configuration to any user-specified server using `chrome.proxy.settings.set()`. If a malicious macro is delivered (e.g., via a crafted bookmarklet on a visited pag…	10.1.0
12	Privilege Escalation	high	AsyncFileIO.js (line 9)	This file opens a native messaging channel to `com.ipswitch.imacros.fio`, which moves the extension beyond normal Chrome sandbox boundaries. Once that host is present, the extension can delegate sensitive filesystem o…	10.1.1
13	Privilege Escalation	high	AsyncFileIO.js (line 286)	The extension exposes native-host-backed primitives to read and write arbitrary text files identified by path-like `NodeObject`s. In practice this gives macro-driven code local file system access that ordinary extensi…	10.1.1
14	Unauthorized Data Collection	high	nm_connector.js (line 91)	This path captures the visible browser tab and saves the image to disk through the native file I/O bridge. That is a direct screen-capture capability tied to filesystem output, which could be abused to collect sensiti…	10.1.1
15	Code Injection	medium	mplayer.js (line 4027)	Eval requests are dispatched to the sandbox iframe using `postMessage` with a wildcard `"*"` target origin. This means any window that has a reference to the sandbox iframe's window object can receive the message. Any…	10.1.0
16	Privilege Escalation	medium	nm_connector.js (line 280)	The extension unconditionally calls `nm_connector.startServer()` on every load (bg.js line 763), establishing a persistent native messaging connection to `com.ipswitch.imacros.host`. This native host runs as a local p…	10.1.0
17	Tracking	medium	utils.js (line 442)	On every install and update event, the background script calls `link(getRedirFromString("welcome"))` and `link(getRedirFromString("updated"))` respectively, opening a tab to `http://rd.imacros.net` with the extension …	10.1.0
18	Unauthorized Data Collection	medium	content_scripts/bookmarks_handler.js (line 93)	This content script runs on every HTTP/HTTPS/file page at `document_start` in the top frame. On page load, it evaluates an XPath query across the entire DOM to find all anchor elements whose `href` begins with `javasc…	10.1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


mathiasbynens.be	/notes/css-escapes	http://mathiasbynens.be/notes/css-escapes
www.softkit-bg.com	-	http://www.softkit-bg.com
www.w3.org	/TR/xhtml11/DTD/xhtml11.dtd	http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
www.ipswitch.com	-	https://www.ipswitch.com
www.apache.org	/licenses/LICENSE-2.0	http://www.apache.org/licenses/LICENSE-2.0
investors.progress.com	/governance.cfm	http://investors.progress.com/governance.cfm
www.progress.com	/support.	https://www.progress.com/support.
www.progress.com	/legal/privacy-policy.	https://www.progress.com/legal/privacy-policy.
www.progress.com	/docs/default-source/progress-software/data-processing-addendum.pdf	https://www.progress.com/docs/default-source/progress-software/data-processing-addendum.pdf

Showing 1 to 10 of 90 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


0.8.1.1	IPv4	-
1.10.1.1	IPv4	-
1.10.1.2	IPv4	-
1.10.1.3	IPv4	-
1.10.2.1	IPv4	-
3.2.1.1	IPv4	-
3.2.1.2	IPv4	-
3.2.1.3	IPv4	-
3.2.1.4	IPv4	-
3.2.1.5	IPv4	-
3.2.2.1	IPv4	-
3.2.2.2	IPv4	-
3.2.4.1	IPv4	-
3.2.2.3	IPv4	-
3.2.2.4	IPv4	-

Showing 1 to 15 of 20 rows

Rows per page:

4.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Ótimo. funciona perfeitamente, desde que você saiba usar os diferentes tipos de gravação que e oferecido e tenha alguma macro antigos para pegas alguns comandos avançados e adicionar a nova gravação.

Ronaldo·30 Dec 2024

I love this and use this everyday, all day! I really need it and there is nothing else like it out there! Is there another app anyone recommends?

Clara Kleptz·23 Oct 2024

I love this and use this everyday, I am bummed a bit that its no longer supported. What should we do?

Donnie Harding

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

iMacros for Chrome

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions18

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating