What our analysis found

MI CIERRO is rated caution by Extension Auditor. Our code review reported 4 findings (2 critical, 2 high), led by remote code loading. It comes from a publisher with 51 extensions and was last updated in September 2026.

Key findings

• critical· remote code loading —Every 10 minutes the background fetches a JSON config from the publisher-controlled domain and immediately forwards it to the WhatsApp content script as an 'Update_DomSelector' payload. This gives the operator the ability to remotely change which WhatsApp DOM elements the content script targets without publishing an extension update, a classic delayed-malicious-payload delivery channel. No data-collection disclosure covers this remote-update mechanism.
• critical· credential theft —Pages hosted on or (both listed in externally_connectable) can send a 'user_auth' or 'open_whatsapp' message that causes the background to navigate the user's live WhatsApp tab to a URL embedding an arbitrary bearer_token. The injected content script running in that WhatsApp tab can then read window.location.search and relay the token to the publisher's backend — a token-theft-via-URL-injection pattern consistent with the 'WaSteal' IoC attribution.
• high· credential theft —On install the extension scans all open Chrome Web Store tabs and extracts any 'bearer_token' URL parameter. The token is then injected into a freshly-opened WhatsApp tab URL (line 116). While presented as an auth handshake, silently harvesting tokens from other browser tabs without user consent and injecting them into navigation URLs constitutes unauthorized token capture; CWS-disclosed data collection is empty.
• high· remote code loading —The extension hard-codes an explicit 'remote_code' endpoint alongside the external config URL. The D() handler (line 382) retrieves this value from the remote config and logs an error if absent, indicating the extension expects an externally-supplied code URL — a direct indication of a remote-code-loading architecture even if the loader script itself is not visible in this bundle.

This extension carries a documented IoC flag ('WaSteal' from, added 2026-05-13) and the code confirms the mechanism: fetches a remote config from every 10 minutes and pushes dynamic DOM-selector updates into the WhatsApp content script (Update_DomSelector), enabling server-controlled retargeting of scraped elements without a new release. Separately, the background handles externally-connectable messages from and — on 'user_auth'/'open_whatsapp' actions it navigates the live WhatsApp tab to >, injecting an authentication credential into a URL that the injected content script can then read and exfiltrate; no data collection is disclosed in CWS. The permhash cluster corroborates (92% malware, peers), publisher reputation partially contradicts ( other extensions flagged), but the IoC attribution and remote-config backdoor are decisive.