Security Alert: Confirmed Malware
POPCAT HACK
ID: eccbdllelaajpodcngjbmejmdmfebjkg
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- mrericwongView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
The BEST autoclicker made for POPCAT, developed and used by the Hong Kong Champion!
Are you ready to unleash the ultimate clicking power? Introducing POPCAT HACK, the must-have Chrome extension for all popcat.click enthusiasts and champions! Take your clicking skills to the next level and dominate the leaderboard for your country like never before! In 2021, armed with POPCAT HACK, I embarked on a click-counting journey like no other. With unwavering determination, I left the extension running for weeks, tirelessly accumulating an astonishing 50 billion clicks. As the champion of Hong Kong, I proudly held our position atop the leaderboard for nearly a year, a testament to the unparalleled efficiency of this remarkable tool. Now, it's time to share this incredible clicker with the world. Join the league of champion and experience the thrill of skyrocketing click counts! ***************************************************** KEY FEATURES: 1. User-friendly GUI for settings. 2. Automatic red eye detection and removal system. 3. Comes with the most optimised settings (from 1 year of experience) 4. Custom keybindings to start and stop the clicker. HOW TO USE: 1. Install the extension and go to https://popcat.click. 2. The clicker should be running! If you're satisfied, you're done! 3. If necessary, you can adjust the speed of the clicker from the popup menu! TRIVIAS: 1. DO NOT go too fast! The game has a system that detects bot clicking, the eyes of the cat will turn red if it detects so. Although we have a red eye detection and removal system on board, it is recommended to leave the settings as default for maximum efficiency! 2. This clicker can still work even if the screen is not focused! Unlike traditional clicker, this clicker uses a special method to register clicks! Feel free to watch videos while this clicker is working for you in the background! 3. For any bug reports or feature suggestions, please send me an email!
The extension explicitly detects when the popcat.click site sets a 'bot' cookie (its anti-cheat mechanism) and immediately clears it via document.cookie assignment before reloading the page. This is deliberate evasion of the site's bot detection system, allowing the automated clicker to continue operating undetected. The counter 'cleared' tracks how many times it has successfully bypassed anti-cheat.
if (getCookieValue("bot") === "true") { clearTimeout(timer) let { cleared } = await chrome.storage.local.get({ cleared: 0 }) cleared += 1 await chrome.storage.local.set({ cleared }) document.cookie = "bot=;" location.reload()} else { scheduleClick()}The extension reads the pop_count score cookie from popcat.click and exposes a UI input that allows the user to set it to an arbitrary value, writing the manipulated value back via chrome.cookies.set. This constitutes direct score/game-state falsification by overwriting the site's score tracking cookie with user-controlled data.
// get the cookie with name: pop_countlet cookie = await chrome.cookies.get({ name: 'pop_count', url: 'https://popcat.click/'})let pops = (cookie?.value || 0) * 1$('.pops') .text(pops)$('#pops') .val(pops) .on('input', function() { pops = $(this) .val() .trim() * 1 let expiry = new Date() expiry.setDate(expiry.getDate() + 7) chrome.cookies.set({ name: 'pop_count', value: `${pops}`, expirationDate: expiry.getTime() / 1000, url: 'https://popcat.click/' }) })The content script injects synthetic Ctrl+G keyboard events into the page DOM at a configurable rate (up to 1000 events per second based on the CPS slider), programmatically simulating user interaction to automate game clicking. Combined with the bot-detection evasion, this constitutes automated manipulation of the site's interaction model without user consent for each event.
async function main() { if (!active) return console.log('clicker stopped') document.dispatchEvent(new KeyboardEvent('keydown', { key: 'g', ctrlKey: true })) document.dispatchEvent(new KeyboardEvent('keyup', { key: 'g', ctrlKey: true }))By severity
Versions scanned
Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.1 | 3 |
Files with findings
2 distinct paths — top paths by unique finding count:
- js/content.js2
- js/popup.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.