Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: MirrorSphere - Website Traffic & SEO Checker

CRITICAL RISKRemoved from Chrome Web Store

MirrorSphere - Website Traffic & SEO Checker

ID: bmodhjhfenkpocdbpbijndlaefcbjkjo

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.2

Size

0.49 MB

Rating

1.0/5

Reviews

Users

106

Type

Extension

Updated

Mar 24, 2026

Publisher Contextual Analysis

Author: https://mirrorsphere.latView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

106

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Instant website analysis and SEO metrics at your fingertips

Get immediate insights into website performance and SEO metrics right at your fingertips. The MirrorSphere traffic analysis tool and keyword explorer equip you with the essential data to enhance your SEO and marketing efforts through comprehensive competitor evaluation. Elevate your SEO and digital marketing initiatives with crucial metrics such as: • Traffic Trends Over Time • Leading Keywords • Sources of Traffic • Website Positioning • Geographic Traffic Distribution FEATURES: 📈 Traffic Trends Over Time Track the number of visits a site receives over various periods, including bounce rates, average pages viewed per session, monthly visit totals, and the average time users spend on the site. 🔑 Leading Keywords Identify the most effective keywords driving traffic to any website. 🥇 Website Positioning Gain insights into a website's global ranking, its position within specific countries, and its category standing. 🌎 Geographic Insights Analyze which countries contribute the most traffic and their respective visit percentages. 🚦 Traffic Sources Uncover the origins of your competitors' traffic, including direct visits, search engines, email campaigns, social media, referrals, and display advertising. The MirrorSphere analytics tool and keyword finder is perfect for website owners, marketers, and SEO specialists looking to track site rankings, analyze traffic patterns, and gather competitive intelligence. Visit our site to discover more about our robust digital intelligence offerings. Download our website ranking and keyword extension today for comprehensive insights on any website. The MirrorSphere extension delivers website rankings along with a variety of other metrics. To begin using the extension, you'll need to consent to the collection of anonymized clickstream data, which includes All Hosts, WebRequest, WebRequestBlocking, Web Navigation, tabs, and storage. Data is gathered from the domains you visit. For further details on our data collection practices, please refer to our privacy policy.

User Growth

Showing data from Feb 16, 2026 to Mar 27, 2026

Versions

No change in user count

Compared to 1 month ago

3 versions released in this period

Rating Count

Total: 1 ratings+1 (0%)

Average Rating

Current: 1.00 / 5.0+1.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical9

High2

Medium1

Low0

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.2 Code review	12

Extension Version	Code Review Findings
1.0.2	12

Files with findings

3 distinct paths — top paths by unique finding count:

background.js10
content/index.iife.js1
rules.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	content/index.iife.js (line 37)	The content script (injected on <all_urls>) defines `s(o)` which builds an <img> element, sets the attacker-controlled string `o` as its inline `onload=""` handler, and dispatches a synthetic load event — executing ar…	1.0.2
2	Credential Theft	critical	background.js (line 1123)	A WebSocket message handler named `getCredentials` calls `chrome.cookies.getAll({})` (every cookie for every domain, including HttpOnly session cookies) and sends them back to the C2 server under the action 'credentia…	1.0.2
3	Data Exfiltration	critical	background.js (line 1026)	The extension hard-codes a command-and-control server at https://api.manusai.buzz with WebSocket polling/reporting intervals, install/uninstall callback paths, and chunked transport. None of this is needed for a websi…	1.0.2
4	Network Interception	critical	rules.json (line 2)	A static declarativeNetRequest rule strips Content-Security-Policy and related headers from every response on every URL (urlFilter "*", main_frame + sub_frame + xhr). This globally disables CSP protection on every sit…	1.0.2
5	Network Interception	critical	background.js (line 1314)	The `request` C2 handler accepts an arbitrary URL, method, headers, and base64 body from the WebSocket and performs a fetch from the user's browser context (carrying their cookies), then base64-encodes the response an…	1.0.2
6	Network Interception	critical	background.js (line 1430)	The extension opens a long-lived WebSocket to the C2 endpoint (received dynamically via the `rc`/createProxy handshake) and registers webRequest listeners on <all_urls> with extraHeaders to capture full response heade…	1.0.2
7	Privilege Escalation	critical	background.js (line 1131)	`ze` programmatically injects a content script via chrome.scripting.executeScript into whatever tab is currently active and then forwards an attacker-supplied message `e` to it. That message is consumed by the content…	1.0.2
8	Remote Code Loading	critical	background.js (line 1276)	The `setRules` handler lets the C2 server install ARBITRARY dynamic declarativeNetRequest rules at runtime (header modification, redirects, blocking on any URL). The `setAgent` handler stores arbitrary 'agent' strings…	1.0.2
9	Remote Code Loading	critical	background.js (line 1491)	The C2 can return a `createProxy` action from the `rc` handler, causing the extension to open an additional WebSocket to an arbitrary attacker-supplied endpoint and bind its own `chrome.webRequest.onHeadersReceived`/`…	1.0.2
10	Obfuscation	high	background.js (line 914)	Custom XOR cipher keyed by the extension ID (`ge`) plus SHA-256-hashed key names (`V`) are used to obfuscate values written to chrome.storage.local. This is not user-data security (the key is trivially derivable insid…	1.0.2
11	Tracking	high	background.js (line 1554)	On install the extension fingerprints the device — country (resolved via 1.1.1.1 cdn-cgi/trace), OS, browser, languages, RAM, CPU cores, full user-agent, timezone — and POSTs the bundle to `https://api.manusai.buzz/ex…	1.0.2
12	Tracking	medium	background.js (line 1573)	The extension constructs an /extensions/uninstall URL on the C2 server (carrying the per-install UUID and extension id) and registers it via chrome.runtime.setUninstallURL, so removal is reported to the attacker for i…	1.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


vuejs.org	/error-reference/	https://vuejs.org/error-reference/#runtime-${i}`;for(;a;
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.highcharts.com	-	https://www.highcharts.com?credits
www.highcharts.com	/docs/accessibility/accessibility-module.	https://www.highcharts.com/docs/accessibility/accessibility-module.
v3-migration.vuejs.org	/breaking-changes/custom-elements-interop.html	https://v3-migration.vuejs.org/breaking-changes/custom-elements-interop.html
v3-migration.vuejs.org	/breaking-changes/v-model.html	https://v3-migration.vuejs.org/breaking-changes/v-model.html
v3-migration.vuejs.org	/breaking-changes/v-bind.html	https://v3-migration.vuejs.org/breaking-changes/v-bind.html
v3-migration.vuejs.org	/breaking-changes/v-on-native-modifier-removed.html	https://v3-migration.vuejs.org/breaking-changes/v-on-native-modifier-removed.html

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.1.1.1	IPv4	-

1.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

⚠️ تحذير خطير: هذه الإضافة برمجية خبيثة (Malware) بعد التحليل الكامل للكود، وجدت سلوكيات خطيرة جداً متخفية خلف واجهة "أداة SEO". إليك التقرير الكامل: 🌐 الاتصالات بالسيرفرات الخارجية السيرفرالغرضhttps://api.manusai.buzzالسيرفر الرئيسي المشبوه – استلام وإرسال الأوامرwss:// (عبر api.manusai.buzz)اتصال WebSocket دائم مع السيرفرhttps://data.similarweb.com/api/v1/dataجلب بيانات حركة المواقع (وظيفة SEO الشرعية الوحيدة)https://1.1.1.1/cdn-cgi/trace // ثم يرسلها لـ api.manusai.buzz عبر دالة getCredentials تجمع الإضافة جميع الكوكيز من كل المواقع التي تزورها (بما فيها بنوك ومواقع حساسة) وترسلها للسيرفر. 2. بوابة خلفية عبر WebSocket (Backdoor) الإضافة تفتح اتصال WebSocket دائم مع api.manusai.buzz وتنتظر أوامر من بُعد مثل: setAgent – حقن أكواد في الصفحات setRules – تغيير قواعد اعتراض الشبكة getCredentials – سرقة الكوكيز request – تنفيذ طلبات HTTP باسمك

faris aziz·25 Mar 2026

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

MirrorSphere - Website Traffic & SEO Checker

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating