Security Alert: Malware Risk Confirmed

This extension is flagged as malware and the latest analysis also reports severe findings. Remove it immediately if installed.Extension: MonokaiToolkit

CRITICAL RISKStill available - exercise caution

MonokaiToolkit

ID: dagbggkfgebkmlmnlidioknbhilfnngn

Extension Info & Metadata

Status

Active

Version

4.1.0

Size

0.55 MB

Rating

3.7/5

Reviews

116

Users

10,000

Type

Extension

Updated

Mar 18, 2026

Publisher Contextual Analysis

Author: creaton.devView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

A super toolset for Social Network Users

MonokaiToolkit (Extension) is a set of various tools for improving your experience while using social networks. We respect your privacy and trying our best to provide you many features to control your "life on Internet" better. With this tool-set, you can: - Remove non-interactive friends. - Control your friend list. - See activity statistics. - See top friends. - Batch remove your contents. - ...and many more features ;)

User Growth

Showing data from Jan 01, 2022 to Feb 16, 2023

Versions

No change in user count

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 74 ratings

Average Rating

Current: 3.78 / 5.0-1.09

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High4

Medium0

Low0

Versions scanned

Showing 1 of 18 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
4.1.0 Code review	9

Extension Version	Code Review Findings
4.1.0	9

Files with findings

4 distinct paths — top paths by unique finding count:

background.js5
content-scripts/fb.js2
content-scripts/content.js1
content-scripts/fb-isolated.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	background.js (line 6754)	Pulls every cookie set on facebook.com (including the session-bearing c_user, xs, and datr — see `Js` on line 6753) and attaches them verbatim to outgoing HTTP requests, then persists the harvested OAuth access token …	4.1.0
2	Data Exfiltration	critical	content-scripts/fb-isolated.js (line 32)	Consumes the intercepted Messenger frames, extracts the c_user cookie to identify the victim, then exfiltrates every incoming message's body, thread ID, sender ID and sender name to the background service worker. This…	4.1.0
3	Network Interception	critical	content-scripts/fb.js (line 229)	Replaces window.WebSocket with a Proxy that silently taps every Messenger socket connection (edge-chat.facebook.com / edge-chat.messenger.com) and republishes the raw frames via postMessage to the isolated content scr…	4.1.0
4	Privilege Escalation	critical	content-scripts/content.js (line 7)	Establishes a postMessage bridge that lets any page on monokaitoolkit.com — and crucially also any page on localhost / 127.0.0.1 — invoke privileged extension RPCs (M8_INIT, M8_EXECUTE, M8_STORAGE, M8_REAUTH, M8_CHROM…	4.1.0
5	Privilege Escalation	critical	background.js (line 6901)	Generic dispatcher that turns whatever method name and args arrive in an M8_CHROME message into a live `chrome.<api>.<method>(...args)` call. Combined with the content-script bridge above, this gives any page on monok…	4.1.0
6	Code Injection	high	content-scripts/fb.js (line 213)	Hijacks Facebook's internal `__d` module-definition function so every module Facebook loads is first run through an arbitrary patch set (window.patches). This gives the extension carte-blanche to monkey-patch Facebook…	4.1.0
7	Credential Theft	high	background.js (line 6941)	On demand (callable from any privileged page via the M8_REAUTH bridge) opens the Facebook Ads Manager re-auth flow in a new tab and watches the navigation. Once the user re-authenticates, the prior access token is pur…	4.1.0
8	Network Interception	high	background.js (line 6582)	Installs declarativeNetRequest rules that forge the Origin / Referer / Sec-Fetch-* headers on requests to facebook.com, m.facebook.com, adsmanager, accountscenter, and the edge-chat WebSocket endpoints. The purpose is…	4.1.0
9	Remote Code Loading	high	background.js (line 6810)	Spins up an offscreen document hosting an MQTT client whenever an `m8_auto_reply_config` is present in storage. The mqtt-worker.html / vesta protobuf stack is set up to receive server-pushed instructions (auto-reply r…	4.1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


react.dev	/errors/	https://react.dev/errors/
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace
www.facebook.com	-	https://www.facebook.com
facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion	-	https://facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion
www.messenger.com	-	https://www.messenger.com
www.instagram.com	-	https://www.instagram.com
www.whatsapp.com	/otp/copy/	https://www.whatsapp.com/otp/copy/

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


133.0.0.0	IPv4	-
99.0.0.0	IPv4	-
120.0.0.0	IPv4	-
138.0.0.0	IPv4	-
127.0.0.1	IPv4	-
250.0.0.14	IPv4	-
105.0.0.0	IPv4	-
126.0.0.0	IPv4	-

2.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Mất tiền mua gói premium để sử dụng mà không sử dụng được tính năng nào, còn không có ai hỗ trợ. Không nên mua

TĐ

Thư Đàm Đức·15 Jul 2026

Anh ơi sao trước nó bay khỏi Cửa hàng Chrome trực tuyến v anh

Sú Anh·11 May 2026

hôm trước vào giao diện đen đẹp dùng được, sao hôm nay tool bị gì vậy, hoàn toàn như 1 web khác luôn, web này giống như bọn bên Cam ấy. Sợ thật sự

Minh Nhựt Trần (Venzízta)

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Malware Risk Confirmed

MonokaiToolkit

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 18 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating