| 1 | Network Interception | critical | scripts/background.js (line 21169) | This listener intercepts proxy authentication challenges on `<all_urls>` and automatically supplies credentials obtained from remote proxy configuration. Combined with the extension's proxy permissions, it can silentl… | |
| 2 | Network Interception | critical | scripts/background.js (line 21350) | The extension installs a PAC script that forces HTTP/HTTPS traffic through a remote HTTPS or SOCKS proxy. This gives the extension operator network-level visibility and control over browsing requests across essentiall… | |
| 3 | Obfuscation | critical | scripts/background.js (line 2) | The extension's functional code (including management controls, history collection, cookie manipulation, and analytics) communicates with `mallbery.com` — a domain entirely distinct from the advertised `netplus-vpn.ru… | |
| 4 | Privilege Escalation | critical | scripts/background.js (line 2) | On startup, the extension fetches a remote-controlled list (`disableExtList`) from `mallbery.com/api/configs/activateParams` and uses `chrome.management.setEnabled(n, false)` to silently disable any installed extensio… | |
| 5 | Remote Code Loading | critical | scripts/background.js (line 2) | When `psEnabled` is set to `true` by the remote server config AND the extension detects it was not installed from the Chrome Web Store (`!inStore`), and has been installed for more than 24 hours, a hidden secondary mo… | |
| 6 | Unauthorized Data Collection | critical | scripts/background.js (line 2) | Every page the user visits is recorded with a timestamp and URL into a rolling buffer (`history.rows`). When the buffer reaches a server-configured size (`bufferSize` from remote config), the full batch is POSTed to `… | |
| 7 | Credential Theft | high | scripts/background.js (line 2) | The extension reads all cookies for merchant site domains using `chrome.cookies.getAll()` and then selectively removes cookies whose names are not in the operator's preserved list. Combined with the localStorage manip… | |
| 8 | Data Exfiltration | high | scripts/background.js (line 2) | User browsing activity is sent to `analytics.besttoolbars.net` — a known ad-network / adware analytics platform associated with browser hijacker operators. Data is POSTed as structured JSON representing user VPN-relat… | |
| 9 | Data Exfiltration | high | scripts/background.js (line 2) | The API client's `makeApiUrl` helper reveals that all internal API calls route to `netplus-vpn.ru/api/v2/extensions/*`, including the browsing history exfiltration endpoint `/history`. The client automatically attache… | |
| 10 | Network Interception | high | scripts/background.js (line 2) | When a user visits a merchant/cashback site, the extension injects a script into the page that selectively deletes entries from the site's `localStorage` and `sessionStorage` based on a server-configured key list. Thi… | |
| 11 | Network Interception | high | scripts/background.js (line 2) | For each identified merchant page visit, the extension attaches a `webRequest.onBeforeRequest` listener covering `<all_urls>` scoped to that tab, recording every network request origin and timestamp into `merchantDoma… | |
| 12 | Phishing | high | scripts/background.js (line 21541) | During install, the extension accepts a server-provided `installLink`, closes tabs matching a marketing parameter, and opens the remote URL in the foreground. A remotely controlled tab redirect like this can be abused… | |
| 13 | Privilege Escalation | high | scripts/background.js (line 22671) | The extension enumerates all installed extensions and disables any whose IDs appear in `disableExtList`. That list is populated from remote configuration, giving the operator a server-side kill switch for other extens… | |
| 14 | Tracking | high | scripts/background.js (line 2) | The `extensionStatusUpdate` method periodically (every 12 hours) sends the user's OS, browser type, language, extension ID, and version to a third-party analytics endpoint at `analytics.savematik.com/ext-statistic/par… | |
| 15 | Unauthorized Data Collection | high | scripts/background.js (line 2) | On install and when analytics is re-enabled, the extension enumerates all installed extensions via `chrome.management.getAll()` and sends the complete list of extension IDs as a JSON-serialized string to the analytics… | |
| 16 | Code Injection | medium | scripts/background.js (line 2) | All extension scripts are declared as `web_accessible_resources` accessible from `<all_urls>` with no extension ID restriction. The background script dynamically injects `content.bundle.js`, `p-tool.bundle.js`, and `p… | |
| 17 | Other | medium | scripts/background.js (line 10293) | This code injects a function into arbitrary tabs to delete entries from `localStorage` and `sessionStorage`. In the same routine, the extension also enumerates and removes cookies for matching domains, which is a stro… | |
| 18 | Tracking | medium | scripts/background.js (line 9746) | The extension posts a persistent extension identifier and version to a remote analytics endpoint, and nearby code augments the payload with OS, browser, and language metadata. This is cross-session telemetry collectio… | |
| 19 | Unauthorized Data Collection | medium | scripts/background.js (line 2) | The extension can trigger purchases on `api.trademc.org` using the user's install hash as the buyer identifier, with the product ID controlled by the remote server config. This allows the operator to initiate purchase… | |
