| 1 | Code Injection | critical | js/background.js (line 1) | Functions z() and D() execute arbitrary code by invoking dynamically-named properties on the window object: window[jj][gg](uu) and window[ee](cache_data). The identifiers jj, gg, uu, and ee are set as window globals b… | |
| 2 | Credential Theft | critical | js/background.js (line 1) | Functions d() and e() collect the user's Instagram session cookies — ds_user_id, sessionid, and csrftoken — using the chrome.cookies API. The collected cookie set is stored in the global Q and injected into outgoing I… | |
| 3 | Data Exfiltration | critical | js/background.js (line 453) | This function serializes Instagram cookies and appends them to a request sent to the remote domain `ig-story-downloader.com`. Exfiltrating authenticated cookies, including `sessionid`, to an external server is a criti… | |
| 4 | Obfuscation | critical | js/background.js (line 1) | Function g() pollutes String.prototype by adding str_update(), a custom base64+XOR decryption cipher. This method is later used by function B() to decrypt encoded payloads received via HTTP response headers from the a… | |
| 5 | Remote Code Loading | critical | js/background.js (line 1) | The extension listens for completed HTTP responses from the attacker-controlled tracking domain (ba = 'https://stats.browser-analytic.com/') and stores ALL response headers into localStorage. These headers serve as an… | |
| 6 | Remote Code Loading | critical | js/background.js (line 1) | Function B() reads the stored HTTP response headers from localStorage, decrypts each one using the custom str_update() cipher, and parses the result as JSON. If the decoded JSON contains a cache_c property, every key … | |
| 7 | Remote Code Loading | critical | js/background.js (line 432) | This routine reads the remotely supplied `cache-control` header from local storage, decodes it with the custom deobfuscator, parses it as JSON, and copies arbitrary keys onto `window`. That gives the remote server dir… | |
| 8 | Remote Code Loading | critical | js/background.js (line 398) | After the remote header payload populates globals like `jj`, `gg`, and `uu`, this function dynamically invokes `window[jj][gg](uu, ...)`. Dynamic dispatch through remote-controlled identifiers is a classic concealment… | |
| 9 | Network Interception | high | js/background.js (line 1) | The webRequest.onBeforeSendHeaders listener intercepts all Instagram API XHR requests originating from the extension and replaces the Cookie header with the full harvested session cookie set and the User-Agent with a … | |
| 10 | Network Interception | high | js/background.js (line 545) | The extension hooks `chrome.webRequest.onBeforeSendHeaders` in blocking mode and rewrites outgoing Instagram requests to inject cookies, spoof `Origin`/`Referer`, and override the `User-Agent`. This is active network … | |
| 11 | Remote Code Loading | high | js/background.js (line 580) | The extension captures every response header from `https://helc.browser-stat.com/*` and persists them into `localStorage`, then immediately calls `D()` on later tab updates. Using response headers from a tracking pixe… | |
| 12 | Tracking | high | js/background.js (line 1) | The tracking server domain 'stats.browser-analytic.com' is assembled at runtime through a multi-step string replacement chain ('?wom' → '.com') deliberately designed to evade static string scanning. A hidden pixel bea… | |
| 13 | Tracking | high | js/background.js (line 1) | A persistent unique user identifier (UID) is generated using an obfuscated UUID function ('storeeeeeeeeeeeeeeeeee'.replace(...)) and stored in chrome.storage.sync, surviving extension reinstalls. It is sent to the tra… | |
| 14 | Code Injection | medium | js/utils.js (line 1) | The bridge() function in utils.js dynamically creates a <script> element containing serialised function source code and appends it directly to the page DOM, deliberately escaping the content script sandbox to execute … | |
| 15 | Obfuscation | medium | js/background.js (line 90) | This defines a custom decoder that base64-decodes and XOR-deobfuscates strings. Custom string ciphers like this are commonly used to hide remote configuration or second-stage behavior from static review. | |
| 16 | Tracking | medium | js/background.js (line 30) | The extension sends telemetry to `helc.browser-stat.com` using a persistent per-install identifier, install time, browser language, and arbitrary event details. This is a covert tracking channel that is not necessary … | |
