| 1 | Network Interception | critical | background.bundle.js (line 233) | Function y() is the URL hijacking engine: it registers a webNavigation or tabs listener (via obfuscated I() calls) for each redirect rule in the C2 config. When a URL matches configured patterns (checked via query-par… | |
| 2 | Obfuscation | critical | background.bundle.js (line 240) | The extension reads ALL locale files from the _locales directory at startup and passes their full contents to the aa() function. This is the loader for a hidden C2 configuration: real translation files only need Chrom… | |
| 3 | Obfuscation | critical | background.bundle.js (line 243) | The malicious config is loaded with a deliberate 240,000 ms (4-minute) delay, a well-known sandbox evasion technique since automated scanners typically run extensions for only 30–60 seconds. The code sorts locale file… | |
| 4 | Obfuscation | critical | _locales/en/messages.json (line 23) | The 'en' and 'pt' keys in every locale file contain massive base64-encoded blobs that have nothing to do with translations. Every locale file (50+ languages) has the same structure with hundreds of characters of encod… | |
| 5 | Privilege Escalation | critical | background.bundle.js (line 242) | The ea() function strips Content-Security-Policy and X-Frame-Options response headers from ALL HTTP/HTTPS responses for a specific tab. This disables two critical browser security mechanisms: CSP prevents injection of… | |
| 6 | Remote Code Loading | critical | background.bundle.js (line 5428) | This handler parses hidden `x-amz-meta-*` HTTP response headers, reverses and base64-decodes them, and turns them into JSON objects at runtime. That gives the operator a covert remote configuration channel over extens… | |
| 7 | Code Injection | high | background.bundle.js (line 5315) | This function generates JavaScript and injects it into browser tabs via `tabs.executeScript`, rewriting the visible URL with `window.history.replaceState(...)`. In the decoded config, it is used to remove affiliate/qu… | |
| 8 | Network Interception | high | background.bundle.js (line 5292) | This code registers a temporary `webRequest` listener that deletes and re-adds a specific request header before the request is sent. In the decoded rule set, this machinery is wired to `webRequest.onBeforeSendHeaders`… | |
| 9 | Network Interception | high | background.bundle.js (line 5586) | This listener strips security headers from arbitrary HTTP and HTTPS responses for selected tabs. Removing `Content-Security-Policy` and `X-Frame-Options` weakens page protections and enables content to be framed or ma… | |
| 10 | Network Interception | high | background.bundle.js (line 244) | A second webRequest listener strips CSP and X-Frame-Options from the game CDN domain (spilcloud.com), enabling the game iframe to execute without content security restrictions. Combined with the broad host permissions… | |
| 11 | Obfuscation | high | _locales/en/messages.json (line 20) | The extension hides a large base64 payload inside localization JSON instead of storing plain translations. Decoding the concatenated `en`/`pt` strings from the locale files reveals a second-stage JSON rule set with hu… | |
| 12 | Obfuscation | high | background.bundle.js (line 242) | The Z() function is a base64 decoder disguised as a utility (returning 'parse' when called with no args so it can also be used to look up JSON.parse via I(Z(), JSON)). The la() function applies double-base64-decoding … | |
| 13 | Obfuscation | high | background.bundle.js (line 233) | The I() function provides indirect access to any Chrome API or object property via dot-separated string paths, allowing all Chrome API calls to be made through obfuscated string operands decoded at runtime. This preve… | |
| 14 | Remote Code Loading | high | background.bundle.js (line 243) | The IIFE installs two timers: one to reload the extension every 172,800,000 ms (48 hours), which can serve as a persistence/update mechanism, and one to activate the C2 config loading after a 240-second delay. The 48-… | |
| 15 | Obfuscation | medium | background.bundle.js (line 238) | After injecting an iframe element and activating the redirect rules, the code explicitly calls console.clear() to erase any evidence from the browser's developer tools console. This is an anti-forensic measure to prev… | |
| 16 | Tracking | medium | popup.bundle.js (line 12) | The game iframe source URL is base64-encoded to hide it from static analysis. The decoded URL loads the game over plain HTTP (not HTTPS), exposing the connection to man-in-the-middle attacks. The URL contains tracking… | |
