Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: TikTok Mobile View

CRITICAL RISKRemoved from Chrome Web Store

TikTok Mobile View

ID: lhkfbcmeheckaeaenlfbfhpmikcppmic

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.4

Size

0.24 MB

Rating

3.7/5

Reviews

Users

166,017

Type

Extension

Updated

Feb 15, 2021

Publisher Contextual Analysis

Author: prihozhaitatiankView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

166,017

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Use the mobile version of TikTok directly in the Chrome browser.

If you haven`t joined our huge community of tiktok users, then you definitely should! This chrome extension is amazing way to have quick access to your favorite video platform just in one click. Basically, it`s TikTok web version with all the popular song and cool sound effects to use. You also can watch, share and upload your own videos. Share highlights from your own life with the world. It`s a type of extension you were looking for. TikTok is a place, where thousands of original content authors share their ideas, show their talent and express themselves.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High4

Medium4

Low1

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.3 Code review	10

Extension Version	Code Review Findings
1.3	10

Files with findings

4 distinct paths — top paths by unique finding count:

js/wigbak/inmorta/btartin/baanGar.js4
js/hteriost/yertendast/fuNdort.js3
js/hifdar/jioknar/hindal/sdXetr.js2
js/nidfar/otunmbra/fadRaq.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Obfuscation	critical	js/wigbak/inmorta/btartin/baanGar.js (line 38)	A function is serialized to a string via `.toString()`, stripped of whitespace to defeat line-based analysis tools, and later injected as dynamic script code. This function also calls `document.currentScript.remove()`…	1.3
2	Code Injection	high	js/wigbak/inmorta/btartin/baanGar.js (line 1)	The extension creates a `<script>` element and sets its `innerHTML` to dynamically constructed JavaScript strings (`nmoVit` and `fiRav`), then injects the element into the page DOM. This pattern—building script conten…	1.3
3	Code Injection	high	js/wigbak/inmorta/btartin/baanGar.js (line 38)	This file constructs inline code as a string and injects it into the page to redefine `navigator.userAgent`, `navigator.appVersion`, `navigator.maxTouchPoints`, and `screen.orientation`. Altering browser fingerprintin…	1.3
4	Network Interception	high	js/nidfar/otunmbra/fadRaq.js (line 21)	The extension uses webRequestBlocking to intercept and rewrite the User-Agent header on all requests to tiktok.com in flight, replacing it with a hardcoded Android mobile UA string. While the stated purpose is mobile …	1.3
5	Network Interception	high	js/hifdar/jioknar/hindal/sdXetr.js (line 12)	This content script is injected into ALL URLs (excluding tiktok.com itself per manifest) and registers a global click event listener on every web page the user visits. It intercepts any click on a link pointing to tik…	1.3
6	Code Injection	medium	js/hteriost/yertendast/fuNdort.js (line 46)	This content script injects additional JavaScript files and CSS directly into the page DOM rather than keeping logic inside the isolated extension world. Main-world script injection at `document_start` is a classic co…	1.3
7	Other	medium	js/wigbak/inmorta/btartin/baanGar.js (line 6)	The extension overwrites `navigator.userAgent`, `navigator.appVersion`, and `navigator.maxTouchPoints` with hardcoded Android mobile device values using `Object.defineProperty`. These properties are set to non-writabl…	1.3
8	Other	medium	js/hifdar/jioknar/hindal/sdXetr.js (line 12)	On pages matched by the broad `<all_urls>` content-script rule, this listener captures clicks on TikTok links, prevents the normal navigation, and reroutes handling through the extension. Cross-site link hijacking is …	1.3
9	Remote Code Loading	medium	js/hteriost/yertendast/fuNdort.js (line 50)	The content script dynamically creates `<script>` elements and injects them into the TikTok page DOM at runtime to load three additional extension scripts not directly declared in the content_scripts manifest entry. E…	1.3
10	Unauthorized Data Collection	low	js/hteriost/yertendast/fuNdort.js (line 48)	A keypress event listener is attached to the window object twice (lines 48-49 and 54-55), which is likely a bug but results in double-firing on every keypress. The handler `gbzerGin` processes Enter key (keyCode 13) e…	1.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.tiktok.com	/trending/	https://www.tiktok.com/trending/
jquery.com	-	https://jquery.com/
sizzlejs.com	-	https://sizzlejs.com/
jquery.org	/license	https://jquery.org/license
github.com	/whatwg/html/issues/2369	https://github.com/whatwg/html/issues/2369
html.spec.whatwg.org	-	https://html.spec.whatwg.org/#nonce-attributes
js.foundation	-	https://js.foundation/
jsperf.com	/thor-indexof-vs-for/5	https://jsperf.com/thor-indexof-vs-for/5
www.w3.org	/TR/css3-selectors/	http://www.w3.org/TR/css3-selectors/#whitespace
www.w3.org	/TR/css-syntax-3/	https://www.w3.org/TR/css-syntax-3/#ident-token-diagram

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.3.3.3	IPv4	-
2.3.3.1	IPv4	-

2.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

垃圾. 劫持浏览器��转到yahoo

红

红朗姆·20 Feb 2021

垃圾. 劫持浏览器跳转到yahoo

红

红朗姆·20 Feb 2021

Manipulates search in the address bar and sends them to Yahoo!!! Manipuliert Suchen im Adressfeld und sendet die zu Yahoo!!!

Ioannis Aslanidis·20 Feb 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

TikTok Mobile View

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews