Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: SaveFrom.net helper

CRITICAL RISKRemoved from Chrome Web Store

SaveFrom.net helper

ID: akncjgblpooaigmieecjiigaebgblnaj

Could be malicious

Supported Languages

🇺🇸English

🇫🇷French

🇩🇪German

🇮🇩Indonesian

🇰🇷Korean

🇷🇺Russian

🇪🇸Spanish

🇹🇷Turkish

🇺🇦Ukrainian

Extension Info & Metadata

Status

Removed

Version

10.53

Size

1.22 MB

Rating

2.0/5

Reviews

239

Users

400,000

Type

Extension

Updated

Mar 8, 2026

Publisher Contextual Analysis

Author: sfhelper.extensionView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

400,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Download Facebook, VK.com, Soundcloud and 40+ sites in one click.

SaveFrom.net helper is an essential tool for downloading media from the internet in one click! It helps you download videos, photos, and music from TikTok, Instagram.com, VK.com, and many others like that. Downloading from VK.com SaveFrom.net helper integrates into the website design, adding a download link for albums with user photos, audio, and video files. While downloading audio files user gets the following features: - Download all mp3 files from the page, - Save mp3 files with proper titles, - Check bitrate and file size of an audio file, - Save the playlist on the computer (to listen to it later on your player). Savefrom Helper features: - Supports popular social networks and video hosting; - Batch download of audio and video recordings, as well as photo albums from social networks; - You can select the quality of downloaded files;

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-20%(-100,000 users)

Compared to 6 months ago

2 versions released in this period

Rating Count

Total: 115 ratings

Average Rating

Current: 2.49 / 5.0-0.06

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical7

High5

Medium3

Low0

Versions scanned

Showing 2 of 34 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
10.53 Code review	10
10.51 Code review	5

Extension Version	Code Review Findings
10.53	10
10.51	5

Files with findings

4 distinct paths — top paths by unique finding count:

background.js12
includes/adgoud.js1
offscreen.js1
sandbox.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	sandbox.js (line 1)	The sandbox page blindly evaluates any string received via postMessage with the 'eval-function' command, with no origin validation (the listener does not check event.origin). Combined with background.js fetching a rem…	10.53
2	Code Injection	critical	offscreen.js (line 149)	The offscreen document acts as an unchecked relay: it forwards ALL chrome.runtime messages (including 'eval-function' with remotely-fetched script) to the sandbox iframe using postMessage with wildcard origin '*'. It …	10.53
3	Data Exfiltration	critical	includes/adgoud.js (line 1)	This file (and an identical copy in background.js) intercepts every URL the user visits via chrome.tabs.onUpdated, SHA-256 hashes the domain, and POSTs it to https://rdtds.net/siblings/find?place=42. If rdtds.net retu…	10.53
4	Network Interception	critical	background.js (line 1)	The extension fetches a 'clickunder' configuration from sf-helper.com specifying target sites and a redirect URL. It then dynamically generates JavaScript code that installs a webRequest.onBeforeRequest listener with …	10.53
5	Remote Code Loading	critical	background.js (line 1)	The extension fetches a remote JavaScript payload from https://sf-helper.com/static/chrome-up.json and dispatches it as an 'eval-function' message via chrome.runtime.sendMessage. This payload is forwarded through offs…	10.53
6	Remote Code Loading	critical	background.js (line 4559)	The background script downloads JSON from a remote server and directly executes `json.body.script` with `eval` in the extension context. This is a classic remote-code-loading/backdoor pattern because the publisher can…	10.51
7	Tracking	critical	background.js (line 1)	Background.js contains a duplicate copy of the adgoud.js URL-tracking module. On install, a persistent 'portId' fingerprint is created using Date.now(). Every tab URL update fires the domain-hashing and rdtds.net look…	10.53
8	Tracking	high	background.js (line 1)	The extension POSTs to sf-helper.com/geoip/country.php with the extension name and version in the X-Helper header to determine the user's geographic country. The country is stored locally with a 3-day expiry and combi…	10.53
9	Tracking	high	background.js (line 8532)	On every tab update, the code extracts the page hostname, hashes it, stores 24 hours of history, and queries a remote service about that hostname. That is a browsing-surveillance pattern, especially concerning because…	10.51
10	Unauthorized Data Collection	high	background.js (line 1)	The extension sends behavioral telemetry events to https://monitoring-exporter.sf-helper.com/event and structured JSON payloads to https://monitoring-exporter.sf-helper.com/api/v3/{type}. These endpoints are not discl…	10.53
11	Unauthorized Data Collection	high	background.js (line 1)	The extension sends behavioral analytics events to Amplitude using a hardcoded API key (bc3c8ed7b305f692ec048b0425b002df). This is in addition to the sf-helper.com monitoring exporter and Google Analytics. The Amplitu…	10.53
12	Unauthorized Data Collection	high	background.js (line 8496)	The extension POSTs visited domains/URLs to `https://rdtds.net/` and then performs a second delayed fetch to a `siblings/click` endpoint using server-provided replacement data. This resembles off-platform click-tracki…	10.51
13	Tracking	medium	background.js (line 1)	The extension sends events to Google Analytics Universal Analytics (UA-67738130-2) and GA4 (G-94HR5L4844) with hardcoded measurement secrets. Each event includes navigator.language, a persistent UUID (cid), extension …	10.53
14	Tracking	medium	background.js (line 8436)	This code creates a persistent local identifier (`portId`) and prepares logic to hash hostnames before further processing. In context with the later `rdtds.net` requests, this looks like per-install tracking of browsi…	10.51
15	Tracking	medium	background.js (line 13614)	The extension sends analytics to Google using a persistent internal UUID (`Br.varCache.uuid`) as `client_id`, together with event metadata and the user's country. This is not outright malware, but it is broad behavior…	10.51

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

112

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/xmlns/	http://www.w3.org/2000/xmlns/
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
example.org	-	https://example.org/
github.com	/facebook/regenerator/blob/main/LICENSE	https://github.com/facebook/regenerator/blob/main/LICENSE
mths.be	/punycode	https://mths.be/punycode
download.sf-helper.com	/chrome/updates-3.xml	https://download.sf-helper.com/chrome/updates-3.xml
download.sf-helper.com	/mozilla/updates.json	https://download.sf-helper.com/mozilla/updates.json
download.sf-helper.com	/safari/update.plist	https://download.sf-helper.com/safari/update.plist
download.sf-helper.com	/chrome/helper.meta.js	https://download.sf-helper.com/chrome/helper.meta.js

Showing 1 to 10 of 120 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-

2.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

chorizo

Darío Fdez Fdez·11 Mar 2026

установлено в опера... но не работает...

СС

Сергей Сергеев·6 Jan 2026

Делайте все по инструкции и все работать будет без проблем, хорошие расширение

Misha2·5 Jan 2026

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

SaveFrom.net helper

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 34 Versions15

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating