Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Notification Manager

CRITICAL RISKRemoved from Chrome Web Store

Notification Manager

ID: obeolenehnecfenafkhhfdalgcngbopb

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

Size

0.02 MB

Rating

5.0/5

Reviews

Users

4,520

Type

Extension

Updated

Jan 12, 2023

Publisher Contextual Analysis

Author: zoesimons.extView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

4,520

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Allows you to create custom notifications for yourself,you can add a text message and set a timer,it will be displayed on time.

The Notification Manager is a browser extension that allows you to set reminders and receive notifications at a later time. With this extension, you can input a custom message and set a timer for when they would like to be reminded. Once the timer ends, the extension will present the notification to the user. This can be a useful tool for managing tasks and staying organized throughout the day!

User Growth

Showing data from Jan 13, 2023 to Jan 18, 2023

Versions

No change in user count

Compared to 5 days ago

1 version released in this period

Rating Count

Total: 1 ratings+1 (0%)

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High3

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1 Code review	7

Extension Version	Code Review Findings
1	7

Files with findings

2 distinct paths — top paths by unique finding count:

background.js4
content.js3

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 633)	The `save` function sends a heartbeat to `https://theoldromanc.com/hb?ext=...&dd=<token>&go=1`, receives an encrypted payload from the C2 server, and stores it under the `dt` localStorage key. This is the mechanism by…	1
2	Data Exfiltration	critical	content.js (line 483)	The `ru()` content script function, called on every page load, decrypts the C2-supplied configuration using AES-CBC with the install token as key material, extracts the user's search query from the current URL using s…	1
3	Remote Code Loading	critical	content.js (line 443)	The extension uses AES-CBC decryption (via `crypto.subtle`) to decrypt a payload received from the C2 server at `theoldromanc.com`. The decrypted JSON object contains function name tables (`fn`) and search engine targ…	1
4	Tracking	critical	background.js (line 506)	On install, the extension beacons to `https://theoldromanc.com/install?ext=Notification Manager&ver=1`, saves the server's response as a token (`dd`) in localStorage, and uses that token to set a custom uninstall trac…	1
5	Obfuscation	high	content.js (line 570)	The `os()` function inspects `window.location.href` (accessed via obfuscated property path from the decrypted `fn` table) and matches the hostname against three sets of search engine patterns (`Q.g`, `Q.y`, `Q.b`) sup…	1
6	Obfuscation	high	background.js (line 1)	Meaningful string constants (the C2 domain `theoldromanc.com`, URL fragments, the extension name, and version) are stored as properties on the `k0IIr` function object and interleaved with dozens of never-executing IIF…	1
7	Unauthorized Data Collection	high	background.js (line 450)	The background script listens for messages from the content script with key `wk: "val"` and accepts a `bod` property containing the current page's `document.body.classList`. It passes this directly to `save()`, which …	1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Roboto:wght@100;300;400;500;700;900&display=swap

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Notification Manager

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating