What our analysis found

SutoflyCRM, WhatsApp Web organizado, automatizado e vendendo is rated caution by Extension Auditor. Our code review reported 2 findings (1 high, 1 medium), led by data exfiltration. It comes from a publisher with 18 extensions and was last updated in September 2026.

Key findings

• high· data exfiltration —On every login, throttled to once per 24 hours by an opaque base64-styled localStorage key, the extension silently POSTs a profile bundle - real name, email, Google auth email, WhatsApp device fingerprint from Conn('getMyDeviceId'), navigator.userAgent, IDs and the user's cross-site advertising cookies (_fbc, _fbp, _ga, _ttclid, _ttp) - with no user action and no UI. The destination is not a fixed publisher domain: is read from the webhooks array that the extension downloads at startup from the reseller's server, so the operator can retarget this feed at any third party without shipping an extension update or passing Chrome Web Store review. The CWS listing declares no data collection at all, and advertising cookies and a device fingerprint bear no relation to a WhatsApp CRM's stated function.
• medium· unauthorized data collection —The same harvested Meta, Google and TikTok advertising cookies are also appended as query parameters onto outbound checkout URLs, confirming the extension maintains a persistent store of the user's cross-site ad-tracking identifiers rather than reading them once in passing. Collecting and forwarding advertising identifiers is unrelated to the declared CRM functionality and is not covered by the listing, which declares no data collection.

The supplied bundle held 10 of 387 files and omitted the three modules:58-65 actually imports, so I recovered the exact CRX from local storage and audited it against the MalExt WaSteal report: this build carries that family's shared cript_key (:27, ffce211a-7b07-4d91-ba5d-c40bb4034a83) and its opaque base64-styled localStorage throttle key, and the report's core behaviour is live here - every 24 hours, with no user action and with CWS data collection declared as 'none', the extension silently POSTs the user's name, email, Google auth email, WhatsApp device fingerprint, userAgent and cross-site advertising cookies () to a webhook URL supplied at runtime by the reseller's server (), so the destination is remotely retargetable without Chrome Web Store review and the first-party-destination defence does not hold. Much of the ML evidence is nonetheless false: there is no remote code execution (the alarming remote_code key is only rendered as a version string, and the sole remote fetch is a CSS DOM-selector), all createElement('script') and eval hits are library idioms, no WhatsApp session credential key appears anywhere in the CRX, the message archive is never exfiltrated, and the api-whatsapp socket is opt-in (default whatsApi.active=false) and write-only. Confidence is medium and the verdict stops short of 'malicious' because the family's worst capabilities are absent from this build (no GTM container, no runtime injection), the product itself is genuine and functional, and the exfiltrated data is the subscriber's own marketing profile going to their vendor rather than harvested third-party contacts.