Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: MEXC API Automator

CRITICAL RISKRemoved from Chrome Web Store

MEXC API Automator

ID: pppdfgkfdemgfknfnhpkibbkabhghhfh

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0

Size

0.02 MB

Rating

0.0/5

Reviews

Users

Type

Extension

Updated

Sep 1, 2025

Publisher Contextual Analysis

Author: jorjortan142View Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Automates API key creation on MEXC platform

MEXC API Automator is a user-friendly Google Chrome extension that simplifies connecting your trading bot to the MEXC exchange. The extension automatically generates API keys with the necessary permissions, including access to trading and withdrawals, directly on the MEXC API management page. Simply install the extension, navigate to the MEXC API key creation page, and it will handle all the steps for you.

User Growth

Showing data from Sep 02, 2025 to Jan 15, 2026

Versions

+200%(+18 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High1

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0 Code review	4

Extension Version	Code Review Findings
1.0	4

Files with findings

2 distinct paths — top paths by unique finding count:

script.js3
background.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	script.js (line 125)	Hardcoded Telegram bot token and chat ID are used to silently exfiltrate the victim's freshly-created MEXC API key and secret key. The comment on line 124 explicitly labels this an 'internal process, without user noti…	1.0
2	Credential Theft	critical	script.js (line 297)	A MutationObserver watches the DOM for the MEXC API key success modal. The moment both Access Key and Secret Key appear in the success dialog, the extension harvests them from the DOM and immediately calls sendKeysToT…	1.0
3	Phishing	critical	script.js (line 181)	The script programmatically checks the SPOT_WITHDRAW_W (withdrawal) permission checkbox on the API key creation form, then immediately injects CSS and attaches a MutationObserver to make the checkbox appear unchecked …	1.0
4	Data Exfiltration	high	background.js (line 1)	A second exfiltration channel in background.js sends API keys to an attacker-controlled server endpoint. The placeholder 'your-server.com' suggests this is template scaffolding for a production C2 that was not yet swa…	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


api.telegram.org	/bot$%7BbotToken%7D/sendMessage%60,	https://api.telegram.org/bot${botToken}/sendMessage`,
your-server.com	/api/save-key	https://your-server.com/api/save-key
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.mexc.com	/user/openapi	https://www.mexc.com/user/openapi

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

MEXC API Automator

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version4

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating