Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Netflixy • نتفلكسي

CRITICAL RISKRemoved from Chrome Web Store

Netflixy • نتفلكسي

ID: kagddenkmcelpodemgjlanjglbnhdknp

Could be malicious

Supported Languages

🇫🇷French

Extension Info & Metadata

Status

Removed

Version

1.2.8

Size

1.57 MB

Rating

3.5/5

Reviews

190

Users

200,000

Type

Extension

Updated

Jul 24, 2023

Publisher Contextual Analysis

Author: https://netflixyapp.github.ioView Profile
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

200,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Profitez d’une meilleure expérience NETFLIX

Netflixy vous donne un accès facile et rapide à votre session Netflix, et ce, à travers votre compte Facebook. En vous connectant avec votre compte Facebook, Netflixy vous permet d'importer instantanément votre session Netflix enregistrée au préalable et directement bénéficier du catalogue Netflix disponible. Fonctionnalités: ► Design simple et innovant ► Authentification rapide et sécurisée ► Accès à Netflix en deux clicks Cette extension requiert que vous ayez déjà enregistré votre session Netflix à travers Netflixy. Pour plus d'informations, veuillez nous contacter sur: E-mail: [email protected] Facebook: fb.me/netflixyapp Instagram: @netflixyapp Quoi de neuf dans cette version ? 1.2.8 - Améliorations diverses.

User Growth

Showing data from Apr 29, 2022 to Apr 28, 2023

Versions

-16.53%(-39,616 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 51 ratings+2 (4%)

Average Rating

Current: 4.82 / 5.0-0.18

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High4

Medium3

Low0

Versions scanned

Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.4 Code review	10

Extension Version	Code Review Findings
1.2.4	10

Files with findings

6 distinct paths — top paths by unique finding count:

api.js2
cookies.js2
dashboard.js2
landing.js2
login.js1
rules.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	cookies.js (line 43)	The extension explicitly steals the Facebook 'c_user' cookie, which contains the user's unique Facebook ID. This identifier is later exfiltrated to the attacker's backend.	1.2.4
2	Credential Theft	critical	dashboard.js (line 34)	This code sends the user's Facebook access token to a backend and then installs returned `NetflixId` and `SecureNetflixId` cookies directly into `.netflix.com`. That is a session-injection flow: the extension is using…	1.2.4
3	Data Exfiltration	critical	api.js (line 4)	The extension downloads its backend host configuration from a remote GitHub file at runtime, then posts a Facebook access token and Facebook profile ID to that server. This gives the operator a remote switch for where…	1.2.4
4	Data Exfiltration	high	landing.js (line 14)	User identification data, including the Facebook access token and profile ID, is exfiltrated to a dynamic backend URL. This allows the publisher to link the extension installation to a specific Facebook account.	1.2.4
5	Network Interception	high	rules.json (line 1)	This declarativeNetRequest rule rewrites the `Origin` header on XHRs to Facebook's `confirm/like` endpoint so the forged engagement request appears to come from `https://www.facebook.com`. That is deliberate network m…	1.2.4
6	Other	high	login.js (line 64)	The extension silently performs a Facebook 'Like' action for `https://www.facebook.com/netflixytn` by scraping CSRF tokens from Facebook's response and replaying them in a POST request. This is an unauthorized action …	1.2.4
7	Tracking	high	dashboard.js (line 88)	The upEngagement function implements a like-jacking attack. It scrapes CSRF tokens (fb_dtsg, jazoest) from a Facebook confirmation page and programmatically submits a 'Like' for the 'netflixytn' page without user cons…	1.2.4
8	Other	medium	cookies.js (line 4)	The clearAllCookies function uses chrome.cookies.getAll with an empty filter, which targets ALL cookies for ALL domains. This is a highly intrusive and destructive action, often used to force users to re-login and cap…	1.2.4
9	Remote Code Loading	medium	api.js (line 4)	The extension uses a dynamic command-and-control mechanism by fetching its backend configuration from a GitHub repository. This allows the attacker to change the destination for exfiltrated data without updating the e…	1.2.4
10	Tracking	medium	landing.js (line 37)	The extension contains a canvas fingerprinting function (fpSensor) designed to uniquely identify and track users across sessions. The resulting fingerprint is exfiltrated to the backend server.	1.2.4

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


raw.githubusercontent.com	/Netflixyapp/netflixy-extension/main/config.json	https://raw.githubusercontent.com/Netflixyapp/netflixy-extension/main/config.json
graph.facebook.com	/v12.0/me	https://graph.facebook.com/v12.0/me?access_token=
www.facebook.com	/v12.0/dialog/oauth	https://www.facebook.com/v12.0/dialog/oauth?client_id=357140426152444&response_type=token&scope=public_profile,email&redirect_uri=https://netflixyapp.github.io/fblogin.html
www.netflix.com	-	https://www.netflix.com/
www.facebook.com	-	https://www.facebook.com/
github.com	/semantic-org/semantic-ui/	http://github.com/semantic-org/semantic-ui/
opensource.org	/licenses/MIT	http://opensource.org/licenses/MIT
github.com	/Semantic-Org/Semantic-UI	https://github.com/Semantic-Org/Semantic-UI
www.semantic-ui.com	-	http://www.semantic-ui.com/
www.famfamfam.com	/lab/icons/flags/	http://www.famfamfam.com/lab/icons/flags/

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

TOP TOP

Ben Mansour Marouan·5 Apr 2024

ynik fi ras

the real wordl·1 Apr 2024

bon site

Raffaele SASSI·14 Mar 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Netflixy • نتفلكسي

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 5 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating