Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Microsoft Rewards & Beautiful New Tab

CRITICAL RISKRemoved from Chrome Web Store

Microsoft Rewards & Beautiful New Tab

ID: dndogceokofjilgeejghbaogjfkdbjbm

Could be malicious

Supported Languages

🇺🇸English

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.0.0.6

Size

15.45 MB

Rating

4.0/5

Reviews

Users

15,366

Type

Extension

Updated

Oct 22, 2022

Publisher Contextual Analysis

Trusted

Author: Microsoft CorporationView Profile
Privacy: Privacy Policy
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: One Microsoft Way Redmond, WA 98052 US
Website: Visit

Total Extensions

850

Active

Obsolete

Listed

831

Unlisted

Total Users

1,168,553,079

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Enjoy Beautiful backgrounds on every new tab page. Earn Microsoft Rewards points for every search on Bing.

Enrich your new tab experience with Beautiful background images. Start a Microsoft Bing web search right from your new tab. By setting Microsoft Bing as your default search engine, you can now easily access any information across the web. Add to Chrome now! What you will get: - Different Beautiful background images on every new tab - Current date and time on new tab - Get easy access to search the web with Bing - See your rewards point balance and status any time - Get easy access to your rewards and redemption pages About Microsoft Rewards It’s the easiest way to get rewarded for doing what you already do. Just search with Bing and shop at the Microsoft and Windows stores to earn free rewards. Just sign in to Microsoft Rewards or join today (https://www.bing.com/explore/rewards). Here’s what you get Movies, music, games, apps, and more. Just redeem the points for the content you want, or use points towards the purchase of an Xbox One and other great devices. No other program gives you benefits for doing the stuff you love with Microsoft products and devices.

User Growth

Showing data from Aug 14, 2022 to Nov 25, 2022

Versions

+153560%(+15,356 users)

Compared to 3 months ago

5 versions released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 4.00 / 5.0+4.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High5

Medium4

Low0

Versions scanned

Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.3 Code review	10

Extension Version	Code Review Findings
1.0.0.3	10

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js8
js/firstSearchNotificationBackground.js1
js/firstSearchNotificationContent.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/firstSearchNotificationContent.js (line 22)	On the user's first Bing search, chrome.scripting.executeScript injects this content script into the active tab, which creates a full-viewport, position:fixed, z-index:1011 iframe sourced from an external Microsoft do…	1.0.0.3
2	Tracking	high	js/background.js (line 231)	setCookies() is called every time background.js loads (on install and each service-worker start) and silently injects two affiliate tracking cookies, `_NTPC` and `_DPC`, into the `.bing.com` domain with `sameSite: 'no…	1.0.0.3
3	Tracking	high	js/background.js (line 317)	A BG_ALARM fires approximately every 500ms and continuously re-registers declarativeNetRequest rules that intercept the user's Bing search URLs and silently replace the `form` and `pc` query parameters with affiliate-…	1.0.0.3
4	Unauthorized Data Collection	high	js/background.js (line 203)	The SendPingDetails function transmits a detailed device fingerprint to http://g.ceipmsn.com over unencrypted HTTP on every install, update, and daily alarm. The beacon includes the persistent machineId GUID, OS strin…	1.0.0.3
5	Unauthorized Data Collection	high	js/background.js (line 30)	On install, the extension silently reads the `__utmz` Google Analytics UTM tracking cookie from `chrome.google.com` (the Chrome Web Store domain) to extract acquisition channel data (source, medium, campaign, content)…	1.0.0.3
6	Unauthorized Data Collection	high	js/background.js (line 121)	On install, the extension reads a cookie named after its own runtime ID from `browserdefaults.microsoft.com` and parses it to extract a server-assigned machineId (MI), partner code (PC), channel (CH), and browser mark…	1.0.0.3
7	Privilege Escalation	medium	js/firstSearchNotificationBackground.js (line 44)	The manifest's `externally_connectable` grants `browserdefaults.microsoft.com` the ability to send messages directly to the extension background via `chrome.runtime.onMessageExternal`. This allows the remote Microsoft…	1.0.0.3
8	Tracking	medium	js/background.js (line 188)	A permanent pseudo-unique 128-bit device identifier ("machineId") is generated and stored in `chrome.storage.local` with no expiry. This GUID is transmitted in every install, update, and daily telemetry ping to `g.cei…	1.0.0.3
9	Tracking	medium	js/background.js (line 391)	When the injected content script (firstSearchNotificationContent.js) sends the `setMachineID` message, the background sets a `MachineID` cookie on `.browserdefaults.microsoft.com` with `sameSite: 'no_restriction'`. Th…	1.0.0.3
10	Tracking	medium	js/background.js (line 62)	On install, if the distribution channel matches certain paid-acquisition patterns (`bgads_fb_` or `bgads_ga_`), the extension opens an unsolicited tab to a Microsoft tracking redirect URL that includes the extension…	1.0.0.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fonts.gstatic.com	/s/roboto/v20/KFOmCnqEu92Fr1Mu72xKOzY.woff2	https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu72xKOzY.woff2
fonts.gstatic.com	/s/roboto/v20/KFOmCnqEu92Fr1Mu5mxKOzY.woff2	https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com	/s/roboto/v20/KFOmCnqEu92Fr1Mu7mxKOzY.woff2	https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu7mxKOzY.woff2
fonts.gstatic.com	/s/roboto/v20/KFOmCnqEu92Fr1Mu4WxKOzY.woff2	https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4WxKOzY.woff2
fonts.gstatic.com	/s/roboto/v20/KFOmCnqEu92Fr1Mu7WxKOzY.woff2	https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu7WxKOzY.woff2
fonts.gstatic.com	/s/roboto/v20/KFOmCnqEu92Fr1Mu7GxKOzY.woff2	https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu7GxKOzY.woff2
fonts.gstatic.com	/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2	https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2
browserdefaults.microsoft.com	-	https://browserdefaults.microsoft.com/
browserdefaults.microsoft.com	/Extensions/FirstTabOverlay/MicrosoftRewardsAndBeautifulnewtab	https://browserdefaults.microsoft.com/Extensions/FirstTabOverlay/MicrosoftRewardsAndBeautifulnewtab
browserdefaults.microsoft.com	/extensions/ChangeItBackInstructions/	https://browserdefaults.microsoft.com/extensions/ChangeItBackInstructions/?xid=2020&version=

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.6	IPv4	-

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Microsoft Rewards & Beautiful New Tab

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 5 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating