Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: ROBO DE PIX

CRITICAL RISKRemoved from Chrome Web Store

ROBO DE PIX

ID: ehkmhachdbadlegpcpmocgchadkdcmii

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

Extension Info & Metadata

Status

Removed

Version

2.0.0

Size

0.59 MB

Rating

2.0/5

Reviews

Users

10,000

Type

Extension

Updated

Mar 6, 2022

Publisher Contextual Analysis

Author: https://robodepix.digitalmidia.app.brView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

ROBO DE PIX

Automação de comentários Extensão que faz o trabalho de comentar automaticamente em fotos de sorteios dentro do Instagram, te poupando tempo de ficar comentando manualmente.

User Growth

Showing data from Mar 08, 2022 to Mar 08, 2022

Versions

No change in user count

No data available

1 version released in this period

Rating Count

Total: 29 ratings+29 (0%)

Average Rating

Current: 1.97 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High3

Medium1

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.0.0 Code review	5

Extension Version	Code Review Findings
2.0.0	5

Files with findings

2 distinct paths — top paths by unique finding count:

index.js4
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	high	manifest.json (line 20)	The extension's CSP weakens the default by allowing `'unsafe-inline'` script elements and explicitly whitelisting the third-party origin `https://digitalmidia.app.br` as a script source, enabling remote code execution…	2.0.0
2	Unauthorized Data Collection	high	index.js (line 8)	The extension uses the victim's authenticated Instagram session to call Instagram's private GraphQL endpoint (query_hash c76146de99bb02f6415203be841dd25a) and the internal `?__a=1` endpoint to scrape the complete foll…	2.0.0
3	Unauthorized Data Collection	high	index.js (line 117)	Second scraping function that paginates Instagram's private GraphQL `edge_follow` endpoint (query_hash d04b0a864b4b54837c0d870b0e77e076) using the victim's authenticated session to harvest the complete `following` lis…	2.0.0
4	Code Injection	medium	index.js (line 1)	The extension overwrites Instagram's own navigation DOM (`div.oJZym` and `div._0aCwM`) by replacing `innerHTML` to inject custom buttons and an outbound link to `robodepix.digitalmidia.app.br`. Modifying first-party I…	2.0.0
5	Tracking	low	index.js (line 72)	Each downloaded list of harvested follower/following data is silently prefixed with `@instabot_oficial` so that the third-party promotional account is injected into every export. This piggybacks promotional content in…	2.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


digitalmidia.app.br;	-	https://digitalmidia.app.br;
cdn.jsdelivr.net	/npm/sweetalert2@11	https://cdn.jsdelivr.net/npm/sweetalert2@11
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/main/LICENSE	https://github.com/twbs/bootstrap/blob/main/LICENSE
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
bootboxjs.com	-	http://bootboxjs.com/
developer.mozilla.org	/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/keys	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/keys
getbootstrap.com	/docs/4.4/getting-started/javascript/	https://getbootstrap.com/docs/4.4/getting-started/javascript/
developer.mozilla.org	/en-US/docs/Web/HTML/Element/input/date	https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/date#Setting_maximum_and_minimum_dates

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

Eu repasso meu acesso vitalício por 70,00. quem quiser chama no zap (71) 9 9605-9409

Ane Souza·7 Mar 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

ROBO DE PIX

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews