Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: OKZOO

CRITICAL RISKRemoved from Chrome Web Store

OKZOO

ID: pebkenjoipcghdahdkdhjoeehiblfgmp

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

0.0.24

Size

8.32 MB

Rating

4.9/5

Reviews

274

Users

10,000

Type

Extension

Updated

Dec 28, 2024

Publisher Contextual Analysis

Trusted

Author: devView Profile
Privacy: Privacy Policy
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 131 Continental Dr suite 305 Newark, DE 19702 US
Website: Visit

Total Extensions

163

Active

Obsolete

Listed

156

Unlisted

Total Users

191,917

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

The Animal Internet: OK?

OKZOO is a new way to surf the internet, crafted as an extension on browsers - a lightweight game standard can be played anywhere on Internet.

User Growth

Showing data from Mar 28, 2024 to Feb 24, 2025

Versions

No change in user count

Compared to 3 months ago

30 versions released in this period

Rating Count

Total: 274 ratings

Average Rating

Current: 4.94 / 5.0+4.94

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High4

Medium0

Low0

Versions scanned

Showing 1 of 30 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.24 Code review	6

Extension Version	Code Review Findings
0.0.24	6

Files with findings

2 distinct paths — top paths by unique finding count:

static/background/index.js4
manifest.json2

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	static/background/index.js (line 187)	A full Solana blockchain wallet infrastructure is hardcoded: a Web3Auth production client ID (`WEB3_CLIENTID`) manages user private keys, a custom Helius RPC endpoint routes on-chain calls, a hardcoded destination wal…	0.0.24
2	Unauthorized Data Collection	critical	manifest.json (line 29)	A single content script is injected with `all_frames: true` into every major social media and communication platform (Twitter/X, Google, Facebook, Instagram, TikTok, Discord, YouTube, Twitch, SoundCloud). Combined wit…	0.0.24
3	Credential Theft	high	static/background/index.js (line 168)	The API configuration includes a `/callback/discord/get` endpoint, indicating the extension intercepts or proxies the Discord OAuth callback flow. When combined with the content script running inside `discord.com` fra…	0.0.24
4	Privilege Escalation	high	manifest.json (line 39)	The wildcard `"*.js"` resource declaration allows pages served from `apis.google.com` to enumerate and load any JavaScript file bundled in the extension. This is an unusually broad grant; legitimate extensions name sp…	0.0.24
5	Tracking	high	static/background/index.js (line 92)	The background script fires on every tab-switch (`onActivated`) and notifies content scripts—which are running inside Twitter, Facebook, Instagram, YouTube, Discord, and other platforms—with a `tabChanged` action. A s…	0.0.24
6	Unauthorized Data Collection	high	static/background/index.js (line 144)	The API layer defines endpoints for automating "social quests" (`/social-quests/complete`, `/social-quests/check`) and "daily quests" on platforms where the content script is injected (Twitter, Instagram, TikTok, YouT…	0.0.24

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

163

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
*.twitter.com	/*	https://.twitter.com/
*.x.com	/*	https://.x.com/
*.google.com	/*	https://.google.com/
*.threads.com	/*	https://.threads.com/

Showing 1 to 10 of 170 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.101.3.4	IPv4	-
1.3.132.0	IPv4	-

4.5 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

oozoo best

bilz badshah·15 Aug 2024

lagged scam

СА

Сергей Аввв·12 Aug 2024

💛最後💛彩蛋邀请码💛雙重積分💛三倍加成�� okz_zkt67 ✅ okz_yi6pf ✅

William Leung·13 May 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

OKZOO

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 30 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating