Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Multi Player

CRITICAL RISKRemoved from Chrome Web Store

Multi Player

ID: pcjkfabahciinpkaiapnkbhifdmolkeo

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

0.0.1

Size

0.12 MB

Rating

5.0/5

Reviews

Users

5,000

Type

Extension

Updated

Mar 23, 2022

Publisher Contextual Analysis

Author: Karimova AngelView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

5,017

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Have you been looking for a good video downloader for a long time? There is good news - Multi Player browser extension will do it…

Have you been looking for a good video downloader for a long time? There is good news - Multi Player browser extension will do it for you. In its functions: auto-detection of video files on the site and saving them via the download button at the pop-up menu. Install the extension and enjoy it!

User Growth

Showing data from Mar 25, 2022 to Apr 20, 2022

Versions

No change in user count

Compared to 26 days ago

1 version released in this period

Rating Count

Total: 25 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical6

High3

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.1 Code review	11

Extension Version	Code Review Findings
0.0.1	11

Files with findings

5 distinct paths — top paths by unique finding count:

background_js/root.js6
background_js/tasks.js2
background.js1
js/background_js/download.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background_js/tasks.js (line 129)	The C2 server can respond with (1) a list of image URLs to silently fetch in the background (ad impression fraud), and (2) a URL to covertly navigate to — either by hijacking an existing muted/inactive tab or by creat…	0.0.1
2	Credential Theft	critical	background_js/root.js (line 148)	Reads all cookies set on the `tds.{c2-domain}` subdomain via `chrome.cookies.getAll` and encodes them into the install event payload sent to the C2 server. These are affiliate/tracking cookies that identify the traffi…	0.0.1
3	Data Exfiltration	critical	background_js/tasks.js (line 77)	Every 60 seconds via an alarm, this function POSTs the complete list of all open browser tabs (including full URLs, titles, and tab metadata) to the C2 server at `generavidtec.online/action`. The server response is th…	0.0.1
4	Obfuscation	critical	background.js (line 1)	The service worker entry point wraps its only meaningful operation (`importScripts`) inside hundreds of lines of random string/number expression statements forming a try/catch block. These dead statements are syntacti…	0.0.1
5	Remote Code Loading	critical	background_js/root.js (line 19)	On install, the extension immediately hard-codes an external C2 domain (`generavidtec.online`) into synced storage as `defaultClickDomain`. This domain is used by every subsequent network call for tracking, task fetch…	0.0.1
6	Unauthorized Data Collection	critical	background_js/root.js (line 102)	On first install, this function exfiltrates a comprehensive browser fingerprint to `generavidtec.online/sub/event`: user agent string, timezone offset, browser language list, extension ID, extension name, app version,…	0.0.1
7	Code Injection	high	background_js/root.js (line 31)	Immediately after install, the extension programmatically injects `tubes.js` into every currently open browser tab using `chrome.scripting.executeScript`, not just tabs matching any declared pattern. This gives the ex…	0.0.1
8	Network Interception	high	js/background_js/download.js (line 121)	The background service worker fetches arbitrary remote URLs on behalf of content scripts to bypass CORS restrictions, parses their HTML with regexes, and returns extracted video URLs. The `deep-frame` handler fetches …	0.0.1
9	Privilege Escalation	high	manifest.json (line 12)	Content scripts run at `document_start` (the earliest possible injection point, before page scripts execute) on every URL (`<all_urls>`), giving the extension access to every page the user visits including banking, em…	0.0.1
10	Tracking	medium	background_js/root.js (line 132)	Registers a remote tracking URL with the browser so that when the user uninstalls the extension, a beacon fires to `generavidtec.online/sub/event?type=uninstall` carrying the user's assigned UUID, extension ID, and ap…	0.0.1
11	Unauthorized Data Collection	medium	background_js/root.js (line 200)	Scans all open tabs for Chrome Web Store URLs and extracts their full query strings (which can contain search terms, referral/affiliate codes, and campaign identifiers). This data is bundled into the install event pay…	0.0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	-	https://*
*	-	http://*
http:	-	http://:
https:	-	https://:
generavidtec.online	-	https://generavidtec.online
chrome.google.com	/webstore	https://chrome.google.com/webstore
www.facebook.com	/video/video_data_async/	https://www.facebook.com/video/video_data_async/?video_id=${id}&fb_dtsg_ag=${token}&__user=${userId}&__a=1`;
www.instagram.com${a}`;	-	https://www.instagram.com${a}`;
vk.com	/al_video.php	https://vk.com/al_video.php?act=show_inline&al=1&video=${id}`;

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

It is convenient, it does not interfere with work. Very user-friendly interface. I advise everyone!

Vladimir Kuznetsov·25 Mar 2022

The extension is not bad, it has all the necessary functions, it is convenient, it does not interfere with work, I like it.

ВС

Владимир Скорупский Скорупский·25 Mar 2022

The extension is not bad, it has all the necessary functions, it is convenient, it does not interfere with work, I like it.

ВС

Владимир Скорупский Скоруп��к��й·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Multi Player

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews