Chrome Web StoreCaution required
Suspicious in code review (v7.4.3.80)
Our reviewer found behaviour consistent with malware in version 7.4.3.80, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
What our analysis found
Primeira Classe is rated caution by Extension Auditor. Our code review reported 3 findings (1 critical, 2 high), led by remote code loading. It comes from a publisher with 51 extensions and was last updated in October 2026.
Key findings
- Critical
Remote Code Loading
Every 10 minutes the background worker fetches `[domain withheld] and forwards the full server-controlled JSON payload (which contains a `remote_code` URL) to every WhatsApp Web tab via the `Update_DomSelector` message. This is a live remote-control channel: the [domain withheld] server can update what the content script reads from WhatsApp's DOM, and the `remote_code` URL can be changed server-side to point to any script. Because the primary content-script files that handle `Update_DomSelector` are absent from the extracted bundle, the full extent of what this config controls cannot be confirmed, but the mechanism itself is a textbook remote-code-loading attack surface.
- High
Remote Code Loading
The extension hardcodes a `remote_code` URL at `[domain withheld] and fetches it as part of the periodic config update cycle. Combined with the WPP Connect library (which gives full read/write access to WhatsApp's internal module store), this URL represents a remotely-updatable code injection point into WhatsApp Web. The commented-out alternative (`[domain withheld]`) indicates active development of this mechanism.
- High
Credential Theft
On installation, the extension scans all open Chrome Web Store tabs for a `bearer_token` query parameter, then closes both WhatsApp and the CWS tabs, and reopens WhatsApp with that token appended to the URL. This forces the WhatsApp page to load with an authentication credential controlled by the [domain withheld] backend embedded in the URL, where the (missing) content script can read it. This is the authentication handshake for linking the victim's WhatsApp session to the attacker-controlled CRM backend.
Analyst notes
The extension is flagged by [domain withheld] as part of the 'WaSteal' campaign (IoC added 2026-05-13), which specifically targets WhatsApp theft. The implements a server-controlled remote configuration mechanism: function `_()` fetches `[domain withheld] every 10 minutes and forwards the entire server response — including a `remote_code` URL field — to the WhatsApp content script via `Update_DomSelector`, enabling the [domain withheld] backend to dynamically control what the extension reads from WhatsApp Web's DOM. The extension bundles WPP Connect (a library giving full access to WhatsApp's internal module store, messages, contacts, and auth keys) and configures a `remote_code` URL at `[domain withheld] — the architecture strongly indicates the missing content scripts (v_7_4_3_80_*, which were not present in the extracted bundle) inject this remote script into WhatsApp Web and relay session data back to the [domain withheld] backend; the 92% malware rate in the permhash cluster corroborates this. The publisher email change, recent update (2 days ago), and low user count (10) are consistent with a maintained stealer operation. The third-party risk score's 'email-change' and 'user-count-low' signals align with this assessment. The permissions themselves are modest and the disclosed CRM purpose is plausible, but the undisclosed remote-code-loading infrastructure and the WaSteal IoC override those mitigating factors.
Primeira Classe Chrome extension security report
ID: fhgjdkfbeghkbgjjkkkldiemdcboimmi
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Intzp
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Email Change History
Screenshots & videos
Install growth
About this extension
Primeira Classe é um CRM para WhatsApp Web. Organize seus chats e otimize seus negócios no WhatsApp Web
Read the publisher’s full description
Com novas funcionalidades para whatsapp web, você pode ter mais controle sobre seus leads além de prospectar mais clientes com envios em massa e exportação de contatos na Primeira Classe. Crie um verdadeiro funil de CRM para vender mais. Características: ✔ Envio em massa para seus contatos ou contatos importados por csv ✔ Crie Abas personalizadas, encontre facilmente seus contatos importantes Visão Kanban dos contatos do whatsapp organize seus leads ✔ Envie mensagens para um número que não esteja na sua agenda ✔ Crie notas para cada contato dentro do contato ✔ Você tem que ligar de volta? Crie lembretes para cada contato ✔ Agende Reuniões no google agenda direto do seu whatsapp ✔ Crie lembretes de forma simples e seja notificado no seu próprio whatsapp web ✔ Crie um banco de respostas rápidas para enviar com um clique ✔ Exporte todos seus contatos do whatsapp ou contatos de grupos de wpp ✔ Use em seu idioma nativo (português, espanhol, inglês) ✔ Borre as mensagens do seu whatsapp web para criar vídeos tutorias ✔ Assistente AI — Sua inteligência artificial pronta para ajudar! Otimize seu tempo com um assistente inteligente, rápido e sempre disponível. Responda dúvidas, automatize tarefas, gere textos, traduções e muito mais com o poder da IA. Ideal para profissionais, equipes e quem busca praticidade no dia a dia. Importante: ✔ Aprovado na auditoria de segurança do Google Chrome ✔ Não usa banco de dados, tudo acontece no seu computador. Primeira Classe é uma extensão independente do Chrome que adiciona recursos extras ao seu WhatsApp web, não fazemos parte do WhatsApp Inc., não temos contrato de uso ou licenças exclusivas. WhatsApp é a marca registrada da WhatsApp Inc.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from Intzp
- Nextgo Zap: Seu Whatsapp Turbinado!464 users
- MI CIERRO460 users
- WhaScale Oficial – Um passo à frente do seu concorrente394 users
- YOUSELLER - Facilidade, produtividade em escala.152 users
- Wa Elo IA94 users
Popular in Tools
- 迅雷下载支持86,000,000 users
- Claude20,000,000 users
- Zotero Connector9,000,000 users
- ChatGPT8,000,000 users
- Browsec VPN - Free VPN for Chrome8,000,000 users