Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Save MateVid

CRITICAL RISKRemoved from Chrome Web Store

Save MateVid

ID: ngggmckedcdhpleghkbkcidhmghjlffi

Could be malicious

Supported Languages

🇺🇸English

🇯🇵Japanese

🇪🇸Spanish

Extension Info & Metadata

Status

Removed

Version

12.1.2.1

Size

0.11 MB

Rating

1.0/5

Reviews

Users

5,472

Type

Extension

Updated

Dec 2, 2022

Publisher Contextual Analysis

Trusted

Author: Tech ExtsaveView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

5,472

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Do you often watch a video and want to download it to your device so you can watch it again later? But you don't want to install…

Do you often watch a video and want to download it to your device so you can watch it again later? But you don't want to install different programs with tools you don't need. Save MateVid will help you with this. Quick save video function, will help you to download videos from social networks and videohostings as vimeo or other websites with video content. You just need to tap the extension icon to see available video files. We would be glad if you rate the app or send feedback to help us flourish. We are tying to be better for you, so we've improved the performance of the extension and added new sites to support

User Growth

Showing data from Jun 17, 2022 to Jan 19, 2023

Versions

-8.8%(-528 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 1.00 / 5.0+1.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High5

Medium2

Low0

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
10.0.0.0 Code review	10

Extension Version	Code Review Findings
10.0.0.0	10

Files with findings

3 distinct paths — top paths by unique finding count:

background.js7
js/content_js/content.js2
js/content_js/providers/fb.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/content_js/content.js (line 1)	When the C2 server issues an `addListener` command, the content script attaches an event listener to `document.body` that intercepts the user's next natural click anywhere on the page and opens the attacker-specified …	10.0.0.0
2	Data Exfiltration	critical	background.js (line 1)	Every minute via chrome.alarms, this function collects the title and URL of ALL active browser tabs and POSTs them encoded to the C2 server at `techservices.one/action`. The server receives a real-time map of the user…	10.0.0.0
3	Remote Code Loading	critical	background.js (line 1)	The C2 server at `techservices.one` responds with a URL that is silently injected into muted, background tabs — redirecting them to arbitrary attacker-controlled pages. It also broadcasts an `addListener` message to a…	10.0.0.0
4	Code Injection	high	background.js (line 1)	Immediately upon installation, the extension queries all currently open browser tabs and injects its content scripts into every one of them using `chrome.scripting.executeScript`. This grants the extension's click-hij…	10.0.0.0
5	Code Injection	high	js/content_js/content.js (line 1)	On command from the background script, the content script injects a full-page CSS blur overlay (z-index 2147483647) that obscures the entire legitimate website, then periodically re-asserts it every 10ms to prevent re…	10.0.0.0
6	Credential Theft	high	js/content_js/providers/fb.js (line 4)	On Facebook pages, this script parses all inline `<script>` tags to extract the user's `async_get_token` (Facebook's CSRF/session token `fb_dtsg_ag`) and numeric `USER_ID` from the page's embedded JavaScript data. The…	10.0.0.0
7	Tracking	high	background.js (line 1)	On first install, the extension phones home to `techservices.one/sub/event` with a detailed device fingerprint: user-agent string, timezone offset, screen dimensions, browser language list, extension version, and the …	10.0.0.0
8	Unauthorized Data Collection	high	background.js (line 1)	This function calls `chrome.cookies.getAll({ domain: 'tds.techservices.one' })` to harvest all cookies stored for the tracking domain, then assembles them into the install payload sent to the C2 server. Combined with …	10.0.0.0
9	Obfuscation	medium	background.js (line 1)	All payloads sent to the C2 server (`techservices.one`) and received install params are obfuscated using a custom scheme: base64-encode then reverse the string character-by-character. This is not standard compression …	10.0.0.0
10	Tracking	medium	background.js (line 1)	The extension registers a chrome uninstall URL that fires a beacon to `techservices.one/sub/event?type=uninstall` containing the user's assigned tracking UUID (`subid`) and affiliate partner ID when the extension is r…	10.0.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


chrome.google.com	/webstore	https://chrome.google.com/webstore
techservices.one	-	https://techservices.one
www.dailymotion.com	/player/metadata/video/$%7Bn%7D	https://www.dailymotion.com/player/metadata/video/${n}?app=com.dailymotion.neon&locale=en&client_type=website`
www.facebook.com	/video/video_data_	https://www.facebook.com/video/video_data_
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	-	https://*
*	-	http://*
http:	-	http://:
https:	-	https://:
www.instagram.com${e}`;	-	https://www.instagram.com${e}`;

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


12.1.2.1	IPv4	-

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Save MateVid

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating