Chrome Web StoreCaution required
Suspicious in code review (v7.4.3.48)
Our reviewer found behaviour consistent with malware in version 7.4.3.48, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
What our analysis found
MERLIN BOT is rated caution by Extension Auditor. Our code review reported 2 findings (2 high), led by remote code loading. It comes from a publisher with 51 extensions and was last updated in October 2026.
Key findings
- High
Remote Code Loading
Every 10 minutes (and on every 'inject-code' trigger) the service worker fetches [domain withheld] and forwards the entire parsed object — including a `remote_code` URL field — to the WhatsApp Web content script via chrome.tabs.sendMessage. The source comment at line 43 labels this variable `// Url do código remoto` (URL of remote code). This is a live remote-code-loading channel: whoever controls [domain withheld] can push arbitrary instructions to the content script running inside WhatsApp Web at any time without an extension update.
- High
Remote Code Loading
The `v()` function is invoked when the content script sends a message with action 'inject-code'. It explicitly validates that the remote config contains a populated `remote_code` URL field, treating its absence as an initialization failure. This function acts as a handshake that confirms the remote code channel is live before the content script proceeds with injection. Paired with the content script's full access to WhatsApp Web (via the WPPConnect library), this provides a covert path to dynamically execute attacker-controlled code inside WhatsApp without any bundled payload.
Analyst notes
The background service worker (:181-191) fetches a remote config from [domain withheld] every 10 minutes and on-demand (via the 'inject-code' message path at line 446), dispatching the full object — including an explicit `remote_code` URL field (noted in source as `// Url do código remoto`) — to the WhatsApp Web content script as `Update_DomSelector`. The `v()` function (line 374-385) explicitly validates that the `remote_code` key is present in the returned config before signalling readiness, confirming this field drives subsequent dynamic code loading in the content script (which is absent from the extracted bundle). This remote-code-loading architecture, combined with an independent IoC from [domain withheld] labelling this extension as 'WaSteal' (added 2026-05-13) and a permhash cluster that is 93% malware (), strongly points to a malicious design. Publisher reputation ( flagged) and the legitimate-looking WPPConnect library in are mitigating signals, but they are outweighed by the IOC, the remote code channel, and the absence of the core content script from the extraction.
MERLIN BOT Chrome extension security report
ID: jkblcpmoooocmdcfjojdecccejlkicap
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Intzp
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
About this extension
MERLIN BOT é um CRM para WhatsApp Web. Organize seus chats e otimize seus negócios no WhatsApp Web
Read the publisher’s full description
Experimente as novas funcionalidades do MERLIN BOT, projetadas para oferecer mais controle sobre seus leads e aumentar suas prospecções de clientes. Com envios em massa e exportação de contatos. Principais Funcionalidades: ✔ Envio em massa para seus contatos ou contatos importados via CSV ✔ Criação de abas personalizadas para fácil localização de contatos importantes ✔ Visão Kanban para organizar seus leads ✔ Envio de mensagens para números não salvos na agenda ✔ Notas personalizadas para cada contato ✔ Criação de lembretes para retornar ligações ✔ Agendamento de reuniões no Google Agenda ✔ Configuração de lembretes simples com notificações ✔ Banco de respostas rápidas para envio com um clique ✔ Exportação de todos os contatos de grupos ✔ Suporte a múltiplos idiomas (português, espanhol, inglês) ✔ Função de borrar mensagens para criação de vídeos tutoriais. ✔ Assistente AI — Sua inteligência artificial pronta para ajudar! Otimize seu tempo com um assistente inteligente, rápido e sempre disponível. Responda dúvidas, automatize tarefas, gere textos, traduções e muito mais com o poder da IA. Ideal para profissionais, equipes e quem busca praticidade no dia a dia. Destaques de Segurança: ✔ Aprovado em auditoria de segurança pelo Google Chrome ✔ Não utiliza banco de dados, todas as operações são realizadas localmente no seu computador MERLIN BOT é uma extensão independente do Chrome que adiciona recursos extras ao seu WhatsApp web, não fazemos parte do WhatsApp Inc., não temos contrato de uso ou licenças exclusivas
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
More from Intzp
- Nextgo Zap: Seu Whatsapp Turbinado!464 users
- MI CIERRO452 users
- WhaScale Oficial – Um passo à frente do seu concorrente382 users
- YOUSELLER - Facilidade, produtividade em escala.152 users
- Wa Elo IA97 users
Popular in Tools
- Montara Chrome Extension639,000,000 users
- 迅雷下载支持85,000,000 users
- ApexGuard VPN Proxy for Chrome10,000,000 users
- Tenelk VPN10,000,000 users
- Zotero Connector9,000,000 users
Store rankings
Where this extension appears in store category, collection and keyword rankings.