Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: PhishRadar by FireShield

CRITICAL RISKRemoved from Chrome Web Store

PhishRadar by FireShield

ID: oaljkhbgbedmfoiieocoenglpaeogjmf

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.0.9037

Size

0.38 MB

Rating

3.8/5

Reviews

Users

100,000

Type

Extension

Updated

May 15, 2025

Publisher Contextual Analysis

Author: https://fireshieldnow.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

730,000

PhishRadar warns you when you try to search for potentially delicate information

Browse the web knowing you're protected from threats like phishing, scams, and other dangers. We create extensions that help keep your searching risk free. Fire Shield alerts you about potentially dangerous searches. The more you become aware, the safer you'll be. Phishing is a type of social engineering attack that tries to steal your personal data such as passwords, credit card numbers, and even social security numbers. These malicious actors often hide behind what appears to be a trusted entity. Phishing scams have gotten a lot more intricate, so you should take extra care of where you browse and who you give out your information to. We develop our extensions in order to help protect you from new and existing threats alike. There is no need to fear going online but you should be aware and make sure you know where you’re headed. The Fire Shield suite of products helps you keep light on your feet and get around the potential dangers that lurk online. The extension switches your search to our search engine (powered by Bing) which stays up to date with the latest dangers and helps keep you safe. Or choose your preferred search engine from a number of safe choices. Search warning notification example: 1. Open the extension popup 2. Turn on email warnings 3. Search for [email protected] 4. See the warning notification We always love to hear your thoughts and comments. Feel more than free to contact us at: [email protected]

User Growth

Showing data from Jan 17, 2024 to Jan 15, 2025

Versions

No change in user count

Compared to 4 months ago

2 versions released in this period

Rating Count

Total: 5 ratings

Average Rating

Current: 3.80 / 5.0-0.20

Item	Type	Severity	Description
webRequest	Permission	Critical	This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
<all_urls>	Host	Critical	Broad host access — the extension can read/modify content on every website.
cookies	Permission	High	This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
Broad Host Permissions	Risk Factor	High	This extension has broad host permissions allowing it to access many or all websites.
tabs	Permission	Medium	This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
notifications	Permission	Low	This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.
alarms	Permission	Low	This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

By severity

Critical2

High2

Medium0

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.3268 Code review	4

Extension Version	Code Review Findings
1.0.0.3268	4

Files with findings

2 distinct paths — top paths by unique finding count:

background.js3
fireAlarm.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	background.js (line 4148)	The extension implements a sophisticated remote-controlled backdoor capable of injecting iframes, stealing HTML content, modifying the DOM, and intercepting events on any web page visited by the user.	1.0.0.3268
2	Tracking	critical	fireAlarm.js (line 169)	The script tracks user browsing by sending the hostname of every page visited to 'https://ext.onfireshield.com/api/fire/alarm' via an image beacon every 30 seconds.	1.0.0.3268
3	Credential Theft	high	background.js (line 8687)	The extension contains specialized logic (including BIN regexes and the Luhn algorithm) to detect and validate credit card numbers, which is highly suspicious for a 'Safe Search' extension.	1.0.0.3268
4	Unauthorized Data Collection	high	background.js (line 286)	The extension collects extensive browser and environment metadata, including machine-specific IDs and management permissions, and exfiltrates it to its backend servers.	1.0.0.3268

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.


onfireshield.com	-	https://onfireshield.com
ext.onfireshield.com	-	https://ext.onfireshield.com
ext.fireshieldme.com	-	https://ext.fireshieldme.com
haveibeenbreached.com	-	https://haveibeenbreached.com
unknow.com	-	http://unknow.com
ext.onfireshield.com	/src/background.js.6457b3512d6c65e47828.map	https://ext.onfireshield.com/src/background.js.6457b3512d6c65e47828.map
ext.onfireshield.com	/api/fire/alarm	https://ext.onfireshield.com/api/fire/alarm
ext.onfireshield.com	/src/fireAlarm.js.6457b3512d6c65e47828.map	https://ext.onfireshield.com/src/fireAlarm.js.6457b3512d6c65e47828.map
ext.onfireshield.com	/src/style.css.6457b3512d6c65e47828.map*/	https://ext.onfireshield.com/src/style.css.6457b3512d6c65e47828.map*/
fireshieldnow.com	-	https://fireshieldnow.com/#contact

Showing 1 to 10 of 30 rows

Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found

4.4 out of 5 · 7 most recent reviews

Text reviews

Positive

Negative

We are looking for a partnership to explore new sources of income for chrome extensions. We believe that this partnership can help your business grow stronger. See more at: https://extensionbuysell.com Looking forward to working with you! Best regards

Madison Francis·19 Sept 2024

Hello, I hope you're having a splendid day! I am currently seeking opportunities to expand my business operations by investing in extensions with a significant user base, beginning from 50,000 users and up. No matter if your extension has a modest user base or counts its users in the millions, I am interested and ready to negotiate a purchase. If you are in possession of such an extension and looking to turn it into a profit, please consider reaching out to me. We can discuss the price and proceed with a transparent and secure transaction through a trusted escrow service based in the United States. It's great that Google allows the transfer of extension ownership between accounts, so your Google account ownership will remain intact. If you have any needs, please contact us via the following contacts Whatsapp: +1 (248) 896‑8035 Telegram: t.me/harryysandersonn

Abner Wirtz·7 Jun 2024

Version	Size	Is Malicious	Findings	Permhash
1.0.0.3268 Latest	0.41 MB	Malicious	4	fc26f8ba85384f04bffa4d3823b390fac5cfbf5d394bbb84400bf15b832ab632
1.0.0.9037	0.38 MB	Malicious	—	3aa331d6867c4101c417e71e5ce54ed827ebfc15b000177a47dfea36f0d05ac4
1.0.0.8677	0.35 MB	Malicious	—	3aa331d6867c4101c417e71e5ce54ed827ebfc15b000177a47dfea36f0d05ac4
1.0.0.5887	0.41 MB	Malicious	—	fc26f8ba85384f04bffa4d3823b390fac5cfbf5d394bbb84400bf15b832ab632

Showing 1 to 4 of 10 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Security Alert: Confirmed Malware

PhishRadar by FireShield

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Code Review Findings Summary Across 4 Versions4

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating