Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Video Load Settings

CRITICAL RISKRemoved from Chrome Web Store

Video Load Settings

ID: mmgkllhfdkaaphopaaacbhjgfmjldpjg

Could be malicious

Supported Languages

🇺🇸English

🇯🇵Japanese

🇪🇸Spanish

Extension Info & Metadata

Status

Removed

Version

1.0.0.2

Size

0.10 MB

Rating

3.0/5

Reviews

Users

8,346

Type

Extension

Updated

Oct 15, 2022

Publisher Contextual Analysis

Trusted

Author: donnasummers6805View Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

8,346

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Video Load Settings allows you to download videos from social networks directly to your device. It detects videos automatically,…

User Growth

Showing data from Jun 07, 2022 to Oct 29, 2022

Versions

-16.54%(-1,654 users)

Compared to 3 months ago

2 versions released in this period

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High4

Medium2

Low1

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.1 Code review	10

Extension Version	Code Review Findings
1.0.0.1	10

Files with findings

3 distinct paths — top paths by unique finding count:

background.js7
js/content_js/content.js2
js/content_js/searchVideos.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 253)	A `chrome.alarms` ticker fires every minute and ships the title and URL of the active tab (i.e. the user's live browsing activity) to netnetwork.click, then executes whatever URL/images/blur instructions the server se…	1.0.0.1
2	Network Interception	critical	background.js (line 289)	The C2 response controls navigation and tracking pixel firing: any returned `images[]` URLs are silently fetched (cookie/pixel firing for ad/affiliate fraud), and any `url` field is force-loaded into a hidden muted ta…	1.0.0.1
3	Privilege Escalation	critical	js/content_js/content.js (line 52)	On EVERY page (matches `:///*`, run_at document_start), the extension hijacks the user's first click on document.body and uses it to `window.open` an attacker-supplied URL — exploiting the click as a user-gesture so…	1.0.0.1
4	Code Injection	high	background.js (line 14)	Immediately after install, the extension iterates every existing browser tab and force-injects its content script via `chrome.scripting.executeScript` so the click-hijack/overlay payload runs on already-open pages wit…	1.0.0.1
5	Phishing	high	js/content_js/content.js (line 93)	Injects a max-z-index full-page blur overlay with a 'Remove blur' button on arbitrary websites and aggressively suppresses any other element trying to compete on z-index (forces them to z-index 1 every 100ms). The ove…	1.0.0.1
6	Tracking	high	background.js (line 135)	Uses the `cookies` permission to read all cookies from the attacker subdomain `tds.netnetwork.click` (a traffic distribution system) to recover affiliate/utm_partner attribution and forward it back to the C2. This is …	1.0.0.1
7	Unauthorized Data Collection	high	background.js (line 101)	On install, the extension exfiltrates the user's User-Agent, browser languages, timezone, app id, install parameters and screen dimensions to the hard-coded C2 server netnetwork.click. The payload is base64-encoded th…	1.0.0.1
8	Obfuscation	medium	background.js (line 443)	A custom string-encoding routine (base64 then reverse) is used to wrap every outbound payload to the C2 (install events, uninstall events, active tab POST body, action queries). It provides no security benefit and exi…	1.0.0.1
9	Tracking	medium	background.js (line 126)	Registers an uninstall URL that beacons the server-issued user UUID, the affiliate utm_partner cookie value, and app metadata to netnetwork.click whenever the user removes the extension. Combined with the install beac…	1.0.0.1
10	Data Exfiltration	low	js/content_js/searchVideos.js (line 29)	With <all_urls> host permission the script reaches into a cross-origin iframe's `contentWindow.document` to harvest a video.src URL and forwards it to the extension. While narrow in target, the pattern bypasses normal…	1.0.0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


netnetwork.click	-	https://netnetwork.click
chrome.google.com	/webstore	https://chrome.google.com/webstore
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	-	https://*
*	-	http://*
http:	-	http://:
https:	-	https://:
www.dailymotion.com	/player/metadata/video/$%7Bt%7D	https://www.dailymotion.com/player/metadata/video/${t}?app=com.dailymotion.neon&locale=en&client_type=website`
vk.com	/al_video.php	https://vk.com/al_video.php?act=show_inline&al=1&video=${e}`,o=new
player.vimeo.com	/video/$%7Be.id.replace(	https://player.vimeo.com/video/${e.id.replace(

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.2	IPv4	-

1.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

Ouvre des onglets et redirige vers des pages douteuses, c'est un mauvais plug-in il vole des informations et force l'utilisateur à consulter des sites malveillants

Charlie Yossa·1 Sept 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Video Load Settings

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating