What our analysis found

Verk - Direto no whatsapp, Automações e IA para vendas is rated caution by Extension Auditor. Our code review reported 3 findings (3 high), led by remote code loading. It comes from a publisher with 51 extensions and was last updated in September 2026.

Key findings

• high· remote code loading —Every 10 minutes (Ten_Minutes alarm, line 241) the background service worker fetches ` — a domain that is neither the publisher's disclosed domain () nor a well-known SaaS. The entire JSON response (which includes a `remote_code` URL per line 377) is immediately pushed verbatim into every WhatsApp Web content-script tab via the `Update_DomSelector` message. This creates a server-controlled injection channel: if the remote server changes ` ` to include executable code references or new DOM selectors that redirect sensitive WhatsApp data, the content script receives them without any update to the extension bundle, consistent with the WaSteal dynamic-payload delivery pattern.
• high· remote code loading —The `v()` function is the handler for the `inject-code` runtime message (line 446-447). It fetches the remote config and checks specifically for a `remote_code` URL property; the error string 'MODULO_EXTERNAL_NOT_INITIALIZED_IN_BACKGROUND' and the variable name `remote_code` leave little ambiguity: this is a guard ensuring a remotely-served JavaScript module was successfully loaded into the WhatsApp Web page context. The actual module execution must occur in the missing main content-script bundle, which is absent from the extracted archive — the most plausible explanation for a 317-file extension presenting only 19 files is deliberate omission of the payload script.
• high· credential theft —On install, the extension scans open Chrome Web Store tabs for a `bearer_token` query parameter (line 137), then closes all WhatsApp Web and Chrome Web Store tabs and reopens WhatsApp Web with the captured token appended to the URL (line 109). Appending an authentication token to a WhatsApp Web URL has no documented legitimate use — WhatsApp Web does not process such parameters — but a content script running on ` can trivially read `window.location.search`. This is a covert token-relay mechanism: the CRM backend places the user's session credential in a URL that the extension then silently routes into the WhatsApp Web page where the (missing) content script can harvest it.

An independent threat-intelligence IoC from (added 2026-05-13) specifically classifies this extension as WaSteal v1.0, a WhatsApp session-stealing malware family — this is dynamic behavioral analysis, not just a pattern score. The source code confirms the technical infrastructure required for that class of attack: fetches ` every 10 minutes (via Ten_Minutes alarm), the config contains a `remote_code` URL that is broadcast to all WhatsApp Web content-script instances, and a dedicated `inject-code` message handler verifies the remote module was successfully loaded. The primary content-script bundle (, ~317 JS files per ML feature counts) is absent from the extracted archive, preventing direct confirmation of credential exfiltration, which is why confidence is medium rather than high. Signals contradicting malice (41 clean publisher extensions, legitimate CRM branding, good user ratings) are consistent with a white-label product whose upstream platform () was compromised or deliberately added a stealing payload in a recent update — the recorded ownership change and the 3-day-old update both fit that scenario.