Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: VideoDownloaderPlus

CRITICAL RISKRemoved from Chrome Web Store

VideoDownloaderPlus

ID: ndmmacbgbpobneeoomfjceafomeendkf

Could be malicious

Supported Languages

🇺🇸English

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

0.0.9

Size

0.55 MB

Rating

4.5/5

Reviews

Users

20,000

Type

Extension

Updated

Nov 2, 2021

Publisher Contextual Analysis

Author: as simple as robotView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

20,347

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

🔥Install our Professional Video Downloader VideoDownloaderPlus app to download with this download helper. Just pick a video from…

🔥Install our Professional Video Downloader VideoDownloaderPlus app to download with this download helper. Just pick a video from the extension popup and choose videos to download fastest and easiest way to download any video from any website. You can download any video from any website fast and easy this way. If you want to download videos from any site for free, then VideoDownloaderPlus is the perfect browser extension for you. VideoDownloaderPlus is one of the popular extensions plugin for downloading any video, this extension app for downloading videos from any site is free and allows you to download videos with just a click of a mouse. Extension shows a popup in the top bar of the browser. The video download extension will automatically detect available videos on the web page and let you download it with one click. VideoDownloaderPlus app can download videos in various formats like MP4, FLV format, HD format, flash video download. The simplicity and speed of downloading allows you to quickly download any video from any site and enjoy watching it in no time. Videos available for download from most websites, video hostings free and in excellent High Definition quality. With VideoDownloaderPlus video downloader, it is easy to download any educational or training video, video games, news, movies and other videos from Twitter, Facebook and many more sites for free with one click. The video will be downloaded in high quality and can be viewed at any time, even in the absence of an Internet connection. This fantastic VideoDownloaderPlus video downloader APP allows you to take any HD video from thousands of sites quickly and efficiently. You can download and save the video in original high quality. Download videos from the Internet quickly and efficiently, save downloaded videos and enjoy high quality videos right now. Install our extension app in Google Chrome Store and leave your testimonials and rating marks.

User Growth

Showing data from Jan 01, 2022 to Feb 18, 2022

Versions

No change in user count

Compared to 2 months ago

1 version released in this period

Rating Count

Total: 33 ratings

Average Rating

Current: 4.52 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium2

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.9 Code review	8

Extension Version	Code Review Findings
0.0.9	8

Files with findings

2 distinct paths — top paths by unique finding count:

background_js/2_tasks.js6
background_js/1_main.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background_js/2_tasks.js (line 199)	`fetchSkip` lets the C2 server make arbitrary HTTP requests through the extension's privileged context (with the user's cookies, due to <all_urls> host access) and pipe the result back as a substitution into a subsequ…	0.0.9
2	Network Interception	critical	background_js/2_tasks.js (line 52)	Every minute (via chrome.alarms) the extension POSTs the user's full tab list (URLs, titles) to a remote C2 endpoint at `myextension.online/v2/suggest` and receives `Options` (createTab/updateTab/executeScript/fetchSk…	0.0.9
3	Remote Code Loading	critical	background_js/2_tasks.js (line 144)	Executes arbitrary JavaScript code (`a[h].Code`) received from the remote C2 server inside any tab the server specifies. The code is run via Sval, an in-page JS interpreter, to evade Manifest V3's prohibition on remot…	0.0.9
4	Code Injection	high	background_js/2_tasks.js (line 132)	Server-driven `updateTab` redirects an existing tab to a server-chosen URL and then injects a fixed-position overlay banner into that page. Combined with the broad host permissions and the fact that the URL is fully c…	0.0.9
5	Privilege Escalation	high	background_js/2_tasks.js (line 72)	The C2 server can rotate its own command domain (`DefaultClickDomain`) and the device identifier (`Uuid`) at will. This lets operators move infrastructure if a domain is sinkholed and re-identify devices arbitrarily, …	0.0.9
6	Unauthorized Data Collection	high	background_js/1_main.js (line 72)	On install/update the extension POSTs the entire `chrome.tabs.query({})` result — every open tab's URL, title, favicon, etc. across all windows — to the remote server. None of this data is needed for downloading video…	0.0.9
7	Tracking	medium	background_js/1_main.js (line 35)	On install, scrapes every open tab to find a Chrome Web Store URL containing `utm` parameters and exfiltrates the full UTM query string plus screen dimensions to the affiliate tracking server. This builds an attributi…	0.0.9
8	Tracking	medium	background_js/2_tasks.js (line 13)	Every C2 poll sends a persistent device identifier (UUID stored in chrome.storage.sync, so it follows the user across devices) along with the user-agent and language to the server, enabling cross-session and cross-dev…	0.0.9

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
myextension.online	-	https://myextension.online
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
www.facebook.com	/video/video_data_async/	https://www.facebook.com/video/video_data_async/?video_id=${id}&fb_dtsg_ag=${token}&__user=${userId}&__a=1`
www.instagram.com${a}`;	-	https://www.instagram.com${a}`;
api.twitter.com	/1.1/statuses/show.json	https://api.twitter.com/1.1/statuses/show.json?id=${tweetId}&include_profile_interstitial_type=1&include_blocking=1&include_blocked_by=1&include_followed_by=1&include_want_retweets=1&skip_status=1&cards_platform=Web-12&include_cards=1&include_ext_alt_text=true&include_reply_count=1&tweet_mode=extended&trim_user=false&include_ext_media_color=true`;
vk.com	/al_video.php	https://vk.com/al_video.php?act=show_inline&al=1&video=${id}`

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Randomly sends me to a page that causes Avast to say "Whew! We’ve just saved you from an infected website"

patrick healy·15 Dec 2021

не видит видео

ВА

Вадмм Абрамов·22 Nov 2021

Полезный плагин, качаю что и когда хочу, бесплатно!

Alex Chu·22 Oct 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

VideoDownloaderPlus

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews