Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Mobile TikTok™

CRITICAL RISKRemoved from Chrome Web Store

Mobile TikTok™

ID: bjflcommipadapdldncoacffcccldlkm

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.1

Size

0.14 MB

Rating

3.9/5

Reviews

Users

206,557

Type

Extension

Updated

Jan 14, 2021

Publisher Contextual Analysis

Author: Mobile View for TikTokView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

206,557

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Mobile TikTok™ - browse and download your favorite videos.

Tik Tok web version allows you to watch amazing videos while surfing the internet via chrome browser. So simply saying, this extension allows you to use TikTok mobile application in your chrome browser. We want you to always have a quickest access to such an amazing and insanely popular community you like. Download your favorite videos, watch them and make on your own using awesome sound effects and popular songs. Application will appear in pop-up tab right in your chrome browser. To open the extension you need to click on its icon in right upper corner of chrome browser. Please, leave your request or comment and don`t forget to share with friends.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High4

Medium5

Low0

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1 Code review	4
1.0 Code review	7

Extension Version	Code Review Findings
1.1	4
1.0	7

Files with findings

5 distinct paths — top paths by unique finding count:

workWithAgent.js4
backgroundPage.js2
openPopupLink.js2
otherScripts.js2
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	workWithAgent.js (line 3)	The extension builds a self-executing JavaScript payload as a string (essentialToAdd + to_inject) and injects it into a freshly created <script> element appended to document.documentElement. This is a deliberate sandb…	1.0
2	Obfuscation	critical	workWithAgent.js (line 53)	The injected payload immediately removes its own <script> element (document.currentScript.remove()) to erase forensic evidence of injection, then permanently overrides Navigator.prototype with configurable:false, writ…	1.0
3	Code Injection	high	otherScripts.js (line 55)	On every TikTok page load, this script dynamically appends <script src=chrome-extension://...> tags for workWithTouches.js and workWithAgent.js into the live page DOM (main world context). Loading extension scripts di…	1.0
4	Network Interception	high	backgroundPage.js (line 67)	The extension registers a blocking webRequest listener that intercepts outgoing headers for all TikTok requests and silently replaces the real User-Agent with a hardcoded Android mobile device string ('Mozilla/5.0 Lin…	1.0
5	Network Interception	high	openPopupLink.js (line 22)	This content script is injected on every website the user visits (<all_urls>) and silently intercepts all click events on every page. When any anchor element whose href contains 'tiktok.com' is clicked, the extension …	1.0
6	Obfuscation	high	workWithAgent.js (line 28)	In addition to the script-tag injection path, the extension also overrides navigator.userAgent, navigator.appVersion, and navigator.maxTouchPoints directly in the content script context via Object.defineProperty, prov…	1.0
7	Code Injection	medium	workWithAgent.js (line 44)	The extension injects a script into the page context and rewrites `navigator.userAgent`, `navigator.appVersion`, `navigator.maxTouchPoints`, and screen orientation properties. Deliberately spoofing browser/device iden…	1.1
8	Code Injection	medium	otherScripts.js (line 22)	This code programmatically injects extension-provided scripts and styles into the live TikTok page rather than keeping logic inside the isolated content-script world. Page-context injection increases the extension's a…	1.1
9	Network Interception	medium	backgroundPage.js (line 59)	The extension uses blocking `webRequest` hooks to rewrite outgoing `User-Agent` headers for TikTok requests. Header tampering is a sensitive interception capability because it alters browser-originated network traffic…	1.1
10	Phishing	medium	openPopupLink.js (line 14)	This content script runs on `<all_urls>` and intercepts clicks to any `tiktok.com` link, prevents the page's normal navigation, and forwards the URL to the background page. Cross-site click interception is unusual for…	1.1
11	Privilege Escalation	medium	manifest.json (line 25)	Two content script entries use run_at: document_start and all_frames: true, giving the extension maximum early-execution privileges across every frame of every page before any page content loads. The web_accessible_re…	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
jquery.com	-	https://jquery.com/
sizzlejs.com	-	https://sizzlejs.com/
jquery.org	/license	https://jquery.org/license
github.com	/whatwg/html/issues/2369	https://github.com/whatwg/html/issues/2369
html.spec.whatwg.org	-	https://html.spec.whatwg.org/#nonce-attributes
js.foundation	-	https://js.foundation/
jsperf.com	/thor-indexof-vs-for/5	https://jsperf.com/thor-indexof-vs-for/5
www.w3.org	/TR/css3-selectors/	http://www.w3.org/TR/css3-selectors/#whitespace
www.w3.org	/TR/css-syntax-3/	https://www.w3.org/TR/css-syntax-3/#ident-token-diagram

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.3.3.3	IPv4	-
2.3.3.1	IPv4	-

1.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

janextupd 删除了

某

某卢·19 Jan 2021

劫持google搜索为yahoo搜索

SanDo Xu·19 Jan 2021

别��载就对了，把google搜索劫持��yahoo

R Siebert·19 Jan 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Mobile TikTok™

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews