Security Alert: Confirmed Malware
smartUp Gestures
ID: bgjfekefhjemchdeigphccilhncnjldn
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- pramajitkumar911View Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
A customizable web browser extension that enhances productivity and efficiency through the use of mouse.
SmartUp Gestures is a mouse gesture extension that allows users to quickly perform various common actions while browsing the web using mouse gestures, thus enhancing productivity and efficiency. Users can customize different mouse gestures to execute different actions, such as forward/backward navigation, opening/closing tabs, scrolling pages, zooming in/out, create post on Facebook, etc... NOTE: After the initial installation is complete, the extension will redirect to a website that displays ads to promote and install other extensions provided by the sponsor. Additionally, there will be a small area on the options page that displays the sponsor's ad. Besides this, we will not insert or display advertisements anywhere else.
Fetches remote JSON (config + product/coupon list) from the developer-controlled server quan.zimoapps.com and pushes it into the content script to render an overlay on arbitrary pages. Because the payload drives on-page UI and outbound affiliate/coupon links, the operator can silently change what users see or click on any site — a classic monetization/affiliate-hijack vector and remote-content update channel outside the Web Store review process.
tbkjx: { getData: function(e, t, n) { let s = "https://quan.zimoapps.com/push/tbkjx.json", o = "https://quan.zimoapps.com/push/config.json?" + _.date.getTime(); fetch(o) .then((e => e.json())) .then((e => { console.log(o), !g("tbkjx_dataversion") || Number(e.version) >= _.date.get() ? (s = s + "?" + _.date.get() .toString(), m("tbkjx_dataversion", e.version)) : s = s + "?" + g( "tbkjx_dataversion"), console.log(s), fetch(s) .then((e => e.json())) .then((e => { chrome.tabs.sendMessage(t.tab.id, { type: "data", value: e }) })) })) },Executes arbitrary user-stored JavaScript strings in the active tab via chrome.tabs.executeScript with `code:` and runAt document_start. Because the stored script list is a simple config blob that is synced via chrome.storage.sync and also written from options.js, any compromise of the synced config (or an attacker who can trigger the jsRun message) yields arbitrary code execution in the context of every page.
jslist: { jsRun: function(e) { chrome.tabs.executeScript({ code: u.general.script.script[e.value].content, runAt: "document_start" }) }},The extension wraps chrome.management.uninstall, setEnabled, and a disableAll helper that iterates every installed extension and disables them (except an allowlist). Combined with an optional `showConfirmDialog:false` path, this gives the extension the ability to silently disable or uninstall other installed extensions — e.g. security/antivirus add-ons — on behalf of a remote message, which is a privilege-escalation / defense-evasion capability not typical of a gesture extension.
itemUninstall: function(e, t, n) { chrome.management.uninstall(e.extId, { showConfirmDialog: u.apps.extmgm.n_uninstallconfirm }, (function(n) { console.log("s"), chrome.management.getAll((function(n) { let s = []; ... disableAll: function(e, t, n) { chrome.management.getAll((function(e) { for (var t = 0; t < e.length; t++) e[t].id == _.extID || u.apps.extmgm.always && u.apps .extmgm.always.contains(e[t].id) || chrome.management.setEnabled(e[t].id, !1) })) }The URL-shortener feature forwards the user's active tab URL (`t.url`) together with a hardcoded YOURLS signature to the developer-controlled endpoint url.zimoapps.com. This gives the operator a stream of browsing URLs tied to users who invoke the feature, and the shared static signature means any third party can also spam/abuse the same endpoint.
shorturl: { getURL: async function(e, t, n) { console.log(e); try { let n = await fetch((u.apps.shorturl.n_suyourls ? "https://url.zimoapps.com/yourls-api.php" : u .apps.shorturl.n_yourls + "/yourls-api.php") + "?action=shorturl&format=json&keyword=" + e .value.key + "&url=" + encodeURIComponent(t.url) + "&signature=" + (u.apps.shorturl .n_suyourls ? "ab279117c0" : u.apps.shorturl.n_sign), { method: "POST" }), s = await n.json();Uses declarativeNetRequest to overwrite the Origin and Referer headers on outbound requests so they appear to originate from https://www.google.com. Spoofing security-sensitive headers to bypass CORS/anti-CSRF origin checks is a known abuse pattern; even if the intent is reverse-image-search, the same rule can be triggered by any background fetch matching that filter.
var v = [{ id: 1, priority: 1, action: { type: "modifyHeaders", requestHeaders: [{ header: "origin", operation: "set", value: "https://www.google.com" }, { header: "referer", operation: "set", value: "https://www.google.com/searchbyimage/upload" }] }, condition: { urlFilter: "www.google.com/searchbyimage/upload", resourceTypes: ["xmlhttprequest"], tabIds: [chrome.tabs.TAB_ID_NONE] }}];chrome.declarativeNetRequest.updateSessionRules({ addRules: v, removeRuleIds: [1]})Registers onMessageExternal using the same dispatch function as the internal onMessage handler without any sender.id allowlist. Every privileged action (extmgm disable/uninstall, jslist code execution, history/bookmark/sessions reads, downloads, shorturl/remote fetches) flows through funOnMessage, so any co-installed or injected extension that can reach this listener gets the same capabilities the extension itself has.
chrome.runtime.onMessageExternal.addListener((function(e, t, n) { _.funOnMessage(e, t, n)})), chrome.runtime.onMessage.addListener((function(e, t, n) { _.funOnMessage(e, t, n)}))pxmovie.getData performs fetch(e.value) where `e.value` is a URL passed in from the content script message. The background has host_permissions `<all_urls>` so it will happily fetch and parse any URL an attacker who can send that runtime message chooses, effectively turning the background into an SSRF/open proxy usable to reach intranet/file-protected endpoints with the extension's privileges.
pxmovie: { getList: function(e, t, n) { fetch("https://www.poxiao.com/") .then((e => e.blob())) .then((e => { var n = new FileReader; n.onload = function(e) { var s = n.result; s = (new window.DOMParser) .parseFromString(s, "text/html"), console.log(s); ... getData: function(e, t, n) { fetch(e.value) .then((e => e.blob())) .then((e => {By severity
Versions scanned
Showing 1 of 17 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 7.3.0 | 7 |
Files with findings
1 distinct path — top paths by unique finding count:
- background.bundle.js7
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.