Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Video Save Tools

CRITICAL RISKRemoved from Chrome Web Store

Video Save Tools

ID: ajofjjankhkhdnmkaogihoaaoajeblaa

Could be malicious

Supported Languages

🇺🇸English

🇯🇵Japanese

🇪🇸Spanish

Extension Info & Metadata

Status

Removed

Version

1.3.1

Size

0.10 MB

Rating

0.0/5

Reviews

Users

8,856

Type

Extension

Updated

Nov 17, 2022

Publisher Contextual Analysis

Trusted

Author: Camil2LANGView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

8,856

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Download Video Save Tools now and enjoy the benefits provided by our application! The effectiveness of our tools allows you to…

Download Video Save Tools now and enjoy the benefits provided by our application! The effectiveness of our tools allows you to quickly and seamlessly download videos from different media platforms such as Tiktok, Dailymotion, Vimo, Vimeo and many others. Be aware that according to Chrome Webstore Policies, this extension does not download video files from YouTube. ******* 1.2.1 - Added more sites for downloading new videos. Enjoy! ******* 1.3.1 - Provided new design for extension. The interface has become more convenient

User Growth

Showing data from Jun 16, 2022 to Feb 26, 2023

Versions

-9.2%(-897 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical8

High3

Medium0

Low0

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.1 Code review	11

Extension Version	Code Review Findings
1.2.1	11

Files with findings

4 distinct paths — top paths by unique finding count:

background.js7
js/content.js2
js/content_js/s-content.js1
scripts/handlers/replacer.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 1)	`/floki` returns an arbitrary `html` blob that the background forwards to a content script which calls `document.body.insertAdjacentHTML('afterbegin', t)` on the live page. Server-controlled HTML is injected into ever…	1.2.1
2	Data Exfiltration	critical	background.js (line 1)	Every minute the service worker harvests the user's active tab title+URL and POSTs it (after custom obfuscation) to attacker endpoints `/action` and `/floki` on `moneyhot.cyou`. The server reply controls extension beh…	1.2.1
3	Network Interception	critical	scripts/handlers/replacer.js (line 1)	This content script (injected at document_start on every URL) scans pages for Google AdSense slots (`[data-google-container-id]`), removes them and replaces them with creative+click URLs fetched from the C2 (`/banner`…	1.2.1
4	Network Interception	critical	js/content_js/s-content.js (line 1)	Search hijacker. The encoded host strings decode (via charCodeAt concatenation) to `www.google.com`, `yandex.ru`, `duckduckgo.com`, and `www.bing.com`. When the user runs a search on any of these engines, the script e…	1.2.1
5	Privilege Escalation	critical	background.js (line 1)	The C2 server returns arbitrary `url`s and image-impression URLs which the extension automatically navigates to in a hidden muted tab and force-opens in every tab on the next user click. This is automated click/impres…	1.2.1
6	Privilege Escalation	critical	js/content.js (line 1)	On every page the content script attaches a global body click listener that, on the very next user click anywhere on the page, opens the C2-supplied `url` in a new tab — converting any legitimate user click into a for…	1.2.1
7	Remote Code Loading	critical	background.js (line 1)	The daily `checker` alarm fetches `/priest` from the C2 and stores the response text directly as `url` in extension storage, then sets `s-state=true`. That stored URL is the prefix the search hijacker (`s-content.js`)…	1.2.1
8	Unauthorized Data Collection	critical	background.js (line 1)	On install the extension hard-codes a C2 endpoint (`https://moneyhot.cyou`), registers a 1-minute alarm `ticker` and a 24h `checker`, and posts install metadata (UA, timezone, languages, app id, install datetime) to `…	1.2.1
9	Obfuscation	high	background.js (line 1)	Custom payload obfuscation (base64 then reversed) is applied to every C2 request body and query string. There is no functional reason to wrap the data this way other than to defeat naive log/network inspection by revi…	1.2.1
10	Phishing	high	js/content.js (line 1)	After landing the user on the attacker URL, the extension covers the page with a max-z-index `backdrop-filter: blur(25px)` overlay and a 'Remove blur' button — coercing the user to interact with attacker-controlled co…	1.2.1
11	Tracking	high	background.js (line 1)	Uses the `cookies` permission to read all cookies under the attacker's traffic-distribution subdomain (`tds.moneyhot.cyou`) and forwards them as install parameters / `utm_partner` affiliate id to the C2. Reading cooki…	1.2.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


chrome.google.com	/webstore	https://chrome.google.com/webstore
moneyhot.cyou	-	https://moneyhot.cyou
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	-	https://*
*	-	http://*
http:	-	http://:
https:	-	https://:
player.vimeo.com	/video/$%7Bt.id.replace(	https://player.vimeo.com/video/${t.id.replace(
www.facebook.com	/video/video_data_	https://www.facebook.com/video/video_data_
vk.com	/al_video.php	https://vk.com/al_video.php?act=show_inline&al=1&video=${e}`,o=new

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Video Save Tools

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating