Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: RoSearcher

CRITICAL RISKRemoved from Chrome Web Store

RoSearcher

ID: eeedicnnmajcnocjdincpiilecdpijdl

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

2.8

Size

0.06 MB

Rating

4.9/5

Reviews

201

Users

5,000

Type

Extension

Updated

Jul 17, 2022

Publisher Contextual Analysis

Trusted

Author: DeveloperView Profile
Privacy: Privacy Policy
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Address: 2570 W El Camino Real Suite 640 Mountain View, CA 94040 US
Website: Visit

Total Extensions

260

Active

138

Obsolete

122

Listed

226

Unlisted

Total Users

26,514

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Updated & Working! Search through the game servers for a player!

RoSearcher is an extension to join your friends who have set their joins to no one. Instructions: 1. Ask your friend who has their joins off to send you a link to their current game. 2. Enter their username or ID into the search field 3. Click join when RoSearcher has found their server. Do not request for me to add the ability to find what game people are in.

User Growth

Showing data from Jul 18, 2022 to Aug 10, 2022

Versions

No change in user count

Compared to 23 days ago

1 version released in this period

Rating Count

Total: 201 ratings-118 (-37%)

Average Rating

Current: 4.90 / 5.0+4.90

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High0

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.8 Code review	6

Extension Version	Code Review Findings
2.8	6

Files with findings

2 distinct paths — top paths by unique finding count:

main.js5
background.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	main.js (line 5)	The extension silently fetches the victim's Roblox home page with the user's session cookies (credentials: include) to scrape the XSRF anti-CSRF token from the HTML. It then calls the authenticated users endpoint to e…	2.8
2	Data Exfiltration	critical	main.js (line 21)	The victim's Roblox username and numeric user ID are immediately exfiltrated to the attacker-controlled domain blox-link.com. The extension also fetches the attacker's own Roblox account ID from the same server (accou…	2.8
3	Data Exfiltration	critical	main.js (line 145)	After each trade attempt, the extension phones back to the attacker's C2 server (blox-link.com) with the outcome and the Rolimons item URLs of the stolen assets, giving the attacker a real-time log of successful theft…	2.8
4	Privilege Escalation	critical	main.js (line 118)	Using the stolen XSRF token, the extension sends authenticated trade requests to Roblox's trade API on behalf of the victim, offering up to four of the victim's valuable limited collectibles in exchange for one cheap …	2.8
5	Unauthorized Data Collection	critical	main.js (line 33)	When the 2FA probe returns HTTP 201, the extension reads the victim's full limited-item collectible inventory using the victim's authenticated session, then also reads the attacker's own collectible inventory to ident…	2.8
6	Code Injection	medium	background.js (line 35)	The background service worker injects a function into the MAIN world (the page's own JavaScript context, not the isolated extension context) to call window.Roblox.GameLauncher.joinGameInstance. Executing in MAIN world…	2.8

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


${url}`	-	https://${url}`
${url}`,	-	https://${url}`,
www.roblox.com	/home	https://www.roblox.com/home
users.roblox.com	/v1/users/authenticated	https://users.roblox.com/v1/users/authenticated
www.roblox.com	/avatar-thumbnail-3d/json	https://www.roblox.com/avatar-thumbnail-3d/json?userId=
blox-link.com	/9/2fa.php	https://blox-link.com/9/2fa.php?id=
blox-link.com	/9/erros.php	https://blox-link.com/9/erros.php?username=
blox-link.com	/9/account.html	https://blox-link.com/9/account.html
inventory.roblox.com	/v1/users/	https://inventory.roblox.com/v1/users/
www.roblox.com	-	https://www.roblox.com/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Its fake real one got deleted oof

alphawolf20-20·9 Aug 2022

Epic extension, works fine

Piłkaman·9 Aug 2022

i hate this dont install it my daughter account got hacked and stealing his limited ITEMS GUYS DONT DOWNLOAD THIS AND STAY SAFE IF YOU DOWNLOAD THIS YOU GONNA GET HACKED AND STEALING LIMITED ITEMS

Gaming With Bageur·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

RoSearcher

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews