Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Video Finder

CRITICAL RISKRemoved from Chrome Web Store

Video Finder

ID: elhaaigmbkooejoamjhbahjhpgncaonf

Could be malicious

Supported Languages

🇺🇸English

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

0.0.4.1

Size

0.11 MB

Rating

4.5/5

Reviews

Users

10,000

Type

Extension

Updated

Jan 15, 2022

Publisher Contextual Analysis

Author: natasha4tambovView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,012

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Video finder extension is a very fast and easy way to download videos from different websites. This extension finds out all…

Video finder extension is a very fast and easy way to download videos from different websites. This extension finds out all videos on the website and shows them at the popup menu, where you can download them in one click. Save your favorite videos and watch them later

User Growth

Showing data from Jan 01, 2022 to Feb 20, 2022

Versions

No change in user count

Compared to 2 months ago

3 versions released in this period

Rating Count

Total: 24 ratings

Average Rating

Current: 4.46 / 5.0-0.18

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High3

Medium2

Low0

Versions scanned

Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.3 Code review	9

Extension Version	Code Review Findings
0.0.3	9

Files with findings

4 distinct paths — top paths by unique finding count:

background_js/root.js4
background_js/helper.js3
background.js1
js/content_js/providers/fb.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background_js/helper.js (line 1)	The `exec()` function accepts a tab ID and arbitrary JavaScript source string, then injects and runs that code into the specified tab via `chrome.scripting.executeScript` using the `Sval` interpreter. This function is…	0.0.3
2	Data Exfiltration	critical	background_js/root.js (line 131)	On install, `SendInstallUpdateEvent` queries ALL open browser tabs using `chrome.tabs.query({})` (no filter) and POSTs the complete tab object array — containing URLs, titles, and metadata for every open page — to the…	0.0.3
3	Remote Code Loading	critical	background_js/helper.js (line 77)	The `loki()` function fetches arbitrary JavaScript source code from a remote C2 server (`myextension.online/loki`) and executes it using the `Sval` interpreter with `sandBox: false`, granting the downloaded code full …	0.0.3
4	Remote Code Loading	critical	background_js/helper.js (line 123)	A recurring alarm named `loki` fires every 5 minutes and triggers the `loki()` function, which downloads and executes fresh remote code from the C2 server. This establishes a persistent command-and-control polling loo…	0.0.3
5	Credential Theft	high	js/content_js/providers/fb.js (line 3)	This content script scrapes Facebook's internal authentication token (`fb_dtsg_ag` / `async_get_token`) and the authenticated user's `USER_ID` from inline page scripts. These credentials are then used to make authenti…	0.0.3
6	Tracking	high	background_js/root.js (line 54)	This function queries all open browser tabs to harvest viewport dimensions and scan for Chrome Web Store URLs containing UTM tracking parameters, then stores these as install parameters transmitted to the server. Comb…	0.0.3
7	Unauthorized Data Collection	high	background_js/root.js (line 86)	The `getInstallParams()` function uses the `cookies` permission to read all cookies set on the third-party domain `tds.myextension.online` and concatenates them into the install parameters that are transmitted to the …	0.0.3
8	Obfuscation	medium	background.js (line 1)	Every JavaScript file in the extension is densely polluted with hundreds of meaningless string literals (fake person names) and random integers evaluated as dead-code expression statements — a deliberate obfuscation t…	0.0.3
9	Tracking	medium	background_js/root.js (line 115)	On every install, the extension registers an uninstall tracking URL at the remote C2 server (`myextension.online/v2/event?type=uninstall`) that fires automatically when the user removes the extension, transmitting the…	0.0.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	-	https://*
*	-	http://*
http:	-	http://:
https:	-	https://:
myextension.online	-	https://myextension.online
ru.brazzers-porno.online	-	https://ru.brazzers-porno.online/
kuklink.co	-	https://kuklink.co/
xxxteens.tv	-	https://xxxteens.tv/
www.xero.porn	-	https://www.xero.porn/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


0.0.4.1	IPv4	-

3.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

It pops up ads randomly and cannot be configured to close

张

张骏杰·12 Jan 2022

Complete scam, don't fall for this

Peter Bergeron·15 Dec 2021

It Can't Download Porn Videos :3

Chan Myat Ko Ko·14 Dec 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Video Finder

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 5 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews