Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: NoteMark

CRITICAL RISKRemoved from Chrome Web Store

NoteMark

ID: bbddldccjdblblaoagchfccnpcjinnde

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.0

Size

0.43 MB

Rating

0.0/5

Reviews

Users

Type

Extension

Updated

Jan 6, 2026

Publisher Contextual Analysis

Author: sain718827382View Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Add notes and bookmarks to any website

NoteMark — Add notes and bookmarks to any website.

User Growth

Showing data from Jan 06, 2026 to Jan 27, 2026

Versions

No change in user count

Compared to 21 days ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0 Code review	7

Extension Version	Code Review Findings
1.0	7

Files with findings

2 distinct paths — top paths by unique finding count:

background.js6
content.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Other	critical	background.js (line 76)	Every 10 seconds the extension fetches a live list of alternate backend domains from the primary C2 server and rotates between them for all subsequent API calls. This is a classic C2 domain-rotation / dead-drop patter…	1.0
2	Phishing	critical	background.js (line 377)	The C2 server can push, keyed by user IP, an 'activeNotes' payload with forceNotification=true carrying attacker-supplied title, message, icon, and URL. On delivery the extension creates a browser notification, and cl…	1.0
3	Phishing	critical	content.js (line 1)	When the C2-supplied 'activeNotes' list contains an entry matching the current hostname, the background triggers this content script function with a server-controlled URL. It blocks beforeunload/unload to trap the use…	1.0
4	Code Injection	high	background.js (line 628)	The background script accepts arbitrary HTML from any content script via the 'createTempFile' message type, creates a blob URL from it, and immediately navigates the active tab to that blob URL. This allows any conten…	1.0
5	Tracking	high	background.js (line 350)	Every 10 seconds the background worker POSTs the user's public IP address to the C2 server at /extension/{ip}/notes-sync. This is a covert heartbeat beacon that informs the attacker of which IP addresses have the exte…	1.0
6	Unauthorized Data Collection	high	background.js (line 285)	The extension fetches the user's public IP address from the third-party service api.ipify.org and stores it as 'extensionId', then uses this IP as the persistent device identifier for all C2 server communications. The…	1.0
7	Other	medium	background.js (line 242)	A hardcoded fallback notification title 'X Image Downloader' — a completely different extension name — is embedded in NoteMark's notification handler. This reveals the background.js was copied from or shares a code fa…	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


ext.notemark.click	/api	https://ext.notemark.click/api
${cleandomain}`;	-	http://${cleanDomain}`;
api.ipify.org	-	https://api.ipify.org?format=json
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&display=swap
cdn.jsdelivr.net	/npm/[email protected]/dist/css/bootstrap.min.css	https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css
cdn.jsdelivr.net	/npm/[email protected]/font/bootstrap-icons.min.css	https://cdn.jsdelivr.net/npm/[email protected]/font/bootstrap-icons.min.css

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


120.0.0.0	IPv4	-

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

NoteMark

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating