Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Media Control

CRITICAL RISKRemoved from Chrome Web Store

Media Control

ID: icdfpmnnnmbjmfokpmdcjoaokhahbjkp

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

Size

0.02 MB

Rating

5.0/5

Reviews

Users

5,570

Type

Extension

Updated

Dec 13, 2022

Publisher Contextual Analysis

Author: kimberly.mediaaView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

5,570

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Control Media in your youtube page with a simple click!

Media Control will let the user to control his media in his current page. With a simple click, the user will be able to forward, play, pause and more.

User Growth

Showing data from Dec 14, 2022 to Feb 02, 2023

Versions

No change in user count

Compared to 2 months ago

1 version released in this period

Rating Count

Total: 1 ratings+1 (0%)

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High3

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1 Code review	8

Extension Version	Code Review Findings
1	8

Files with findings

3 distinct paths — top paths by unique finding count:

background.js5
content.js2
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 438)	On install, the extension beacons to the hardcoded C2 domain 'warsalsintrol.xyz/install?ext=Media Control&ver=1', stores a server-issued token ('dd') in local storage, and sets the uninstall URL to track when the user…	1
2	Data Exfiltration	critical	background.js (line 555)	The 'save' function sends the stored C2 token ('dd') as a heartbeat ping to 'warsalsintrol.xyz/hb' and receives an encrypted payload ('dt') from the server, which it stores with an 11000-second TTL. The response drive…	1
3	Remote Code Loading	critical	content.js (line 770)	The extension decrypts a server-supplied ciphertext using AES-CBC with a key derived from the C2-issued token ('dd'). The decrypted result is parsed as JSON and used to drive navigation hijacking — the structure conta…	1
4	Tracking	critical	content.js (line 694)	This function runs on every page load across all HTTP/HTTPS sites. It retrieves the C2 token and server-issued encrypted payload from storage, derives an AES key from the token, decrypts the payload to obtain a config…	1
5	Obfuscation	high	background.js (line 1)	Both background.js and content.js open with an identical obfuscated IIFE that uses hex/unicode escaped property names (e.g., '\x64\x65\u0066\u0069\u006e\x65\u0050\x72\u006f\x70\x65\x72\u0074\x79' decodes to 'definePro…	1
6	Privilege Escalation	high	manifest.json (line 22)	The manifest injects content.js into every HTTP and HTTPS page the user visits, but only declares the 'storage' permission. This broad injection scope is inconsistent with the extension's advertised purpose (YouTube m…	1
7	Unauthorized Data Collection	high	background.js (line 519)	The background service worker listens for messages with key 'wk: val' and payload 'bod', caches the received value under the key 'bod' for ~10740 seconds (~3 hours), and passes it to the 'save' function which exfiltra…	1
8	Obfuscation	medium	background.js (line 59)	The files are padded with dozens of identical unreachable dead-code IIFEs (the condition 'Math.random() > 1' is always false; 'typeof x == null' is always false). These blocks are copied verbatim throughout background…	1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	https:///
*	/*	http:///

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Media Control

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating