Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: User-Agent Switcher

CRITICAL RISKRemoved from Chrome Web Store

User-Agent Switcher

ID: clddifkhlkcojbojppdojfeeikdkgiae

Could be malicious

Extension Info & Metadata

Status

Removed

Version

2.0.1.0

Size

0.14 MB

Rating

4.3/5

Reviews

149

Users

130,806

Type

Extension

Updated

Sep 7, 2020

Publisher Contextual Analysis

Author: https://www.useragentswitch.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

130,806

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

User-Agent Switcher is a quick and easy way to switch between user-agents.

Just right click on any page and select your user-agent. This Chrome extension adds a toolbar button and a menu to switch between user-agents. Browse with our predefined user-agents or add your own user-agents. Changing User-Agent allows you to mimic, spoof or fake other browsers, devices or search engine spiders. The extension does not render web pages in the same way as the selected one. User-Agent Switcher is primarily for developers who want to test how a page responds to different browsers. User-Agent switcher may also be used to reach certain pages that allows a particular browser. You can change User-Agent back to default when you are done. This extension also changes the javascript based "navigator userAgent" Includes presets for iOS (iPhone, iPad), Android, Windows Mobile Phone (Nokia Lumia) and browsers like Chrome, Internet Explorer, Microsoft Edge, Firefox, Safari and Opera etc. Add your own User-Agents if you don´t find anything that suits your needs.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High2

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.0.1.0 Code review	5

Extension Version	Code Review Findings
2.0.1.0	5

Files with findings

2 distinct paths — top paths by unique finding count:

js/background.min.js4
js/content.min.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/background.min.js (line 72)	The extension establishes a persistent Socket.IO connection to an external server at `https://www.useragentswitch.com/`. The remote server can instruct the extension to perform arbitrary HTTP fetch requests (via the `…	2.0.1.0
2	Network Interception	critical	js/background.min.js (line 106)	The remote server can push `handlerData` (a filter object) via Socket.IO. For every outgoing HTTP request from the browser, `handler2` checks if the request fields match the remote-supplied regex filters, and if so, t…	2.0.1.0
3	Remote Code Loading	critical	js/background.min.js (line 72)	The extension loads and executes Socket.IO (`io()`) to connect to a remote C2-like server. The server can remotely configure the extension's behavior at runtime by pushing `handlerData` objects, effectively allowing t…	2.0.1.0
4	Code Injection	high	js/content.min.js (line 1)	The content script dynamically injects a `<script>` tag into every page's `<head>` at `document_start` that overrides `navigator.userAgent` using `__defineGetter__`. While overriding the user-agent is the stated purpo…	2.0.1.0
5	Obfuscation	high	js/background.min.js (line 130)	The `handler2` function applies an unexplained `-zzz` string substitution to the serialized request headers before returning them. This is a form of lightweight obfuscation with no apparent functional purpose for a us…	2.0.1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.esolutions.se	/whatsmyinfo	http://www.esolutions.se/whatsmyinfo
www.useragentswitch.com	-	https://www.useragentswitch.com/
www.apache.org	/licenses/LICENSE-2.0.txt	http://www.apache.org/licenses/LICENSE-2.0.txt
www.bing.com	/bingbot.htm	http://www.bing.com/bingbot.htm
www.googlebot.com	/bot.html	http://www.googlebot.com/bot.html
help.yahoo.com	/help/us/ysearch/slurp	http://help.yahoo.com/help/us/ysearch/slurp
mths.be	/utf8js	https://mths.be/utf8js
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	-	http://*/
*	-	https://*/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


7.2.1.0	IPv4	-
2.0.1.0	IPv4	-

2.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

This extension likes instagram posts in the background from your account. Don't believe me, use a HTTPS sniffer and see for yourself. You will get instagram warnings when logging into the app, sometimes even softbanned from liking. This is awful, I dont believe how this even made it to the chrome store.

Sethu Senthil·14 Oct 2020

Malware extension! Do not install because it generates likes for Facebook and Instagram posts. Who knows what else it could start doing at any moment. Google should remove immediately!

Aleksi Aleksiev·11 Oct 2020

WARNING - DANGER: Opens a websocket that performs likes on FB/Instagram on your behalf without notice. I call this malware

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

User-Agent Switcher

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews