Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Videogo link

CRITICAL RISKRemoved from Chrome Web Store

Videogo link

ID: djnhpfdfedaeckljpdjgjhhogopdanoe

Could be malicious

Supported Languages

🇺🇸English

🇯🇵Japanese

🇪🇸Spanish

Extension Info & Metadata

Status

Removed

Version

1.0.1

Size

0.09 MB

Rating

3.0/5

Reviews

Users

7,016

Type

Extension

Updated

Dec 23, 2022

Publisher Contextual Analysis

Trusted

Author: TaylorView Profile
Privacy: Privacy Policy
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 1942 Broadway ste 314c Boulder, CO 80302 US

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

7,073

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

When viewing something, do you want to watch it again offline and share it with your friends. Videogo link is a tool for saving…

When viewing something, do you want to watch it again offline and share it with your friends. Videogo link is a tool for saving videos from different web sources. It will help you quickly download a video file in one click. To do this, you need to: install the extension, go to your site and tap on the extension icon to display the files for download. In new version we made design nicer and more convenient for you in new version of our extension. And provided for you downloading from vimo.uz. Enjoy! You can see here a tutorial: https://www.youtube.com/watch?v=o3pJBY9cRXI

User Growth

Showing data from Jun 18, 2022 to Feb 26, 2023

Versions

-16.61%(-1,397 users)

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 2 ratings

Average Rating

Current: 3.00 / 5.0+3.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical7

High3

Medium2

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.2 Code review	12

Extension Version	Code Review Findings
0.0.2	12

Files with findings

4 distinct paths — top paths by unique finding count:

background.js8
content.js2
js/content_js/replacer.js1
js/s-content.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	content.js (line 1)	The content script accepts arbitrary HTML strings sent via chrome.runtime.sendMessage with type '+html' and prepends them into document.body via insertAdjacentHTML. The HTML originates from the C2 server's /floki resp…	0.0.2
2	Data Exfiltration	critical	background.js (line 1)	On a 1-minute alarm, the extension exfiltrates the active tab's title and URL (encoded with a custom btoa+reverse obfuscator) to the C2 endpoint /floki, then receives an 'html' payload back which is injected into open…	0.0.2
3	Data Exfiltration	critical	background.js (line 1)	Sister of fetchData: continuously sends active-tab titles/URLs to /action and parses the response into a 'task' (URL to open in muted background tab, images to GET, additionalUrls to navigate). The server can instruct…	0.0.2
4	Network Interception	critical	js/s-content.js (line 1)	Search engine hijacker. The four obfuscated charCode strings decode to www.google.com, yandex.ru, duckduckgo.com, and www.bing.com. When the user is on one of these search engines and the s-state flag is on, the scrip…	0.0.2
5	Network Interception	critical	background.js (line 1)	Executes server-supplied instructions: silently fetches every URL in the 'images' array (covert tracking pixels / click fraud), and navigates a hidden muted tab — or opens a new tab on next user click — to the attacke…	0.0.2
6	Network Interception	critical	js/content_js/replacer.js (line 19)	Scans every page for Google ad slots (elements with data-google-container-id), then asks the C2 server (via background.js fetchBannerCreative -> /banner) for replacement creatives matching the slot dimensions, base64-…	0.0.2
7	Remote Code Loading	critical	background.js (line 1)	The 'checker' alarm fetches a remote endpoint (/priest) on the configured C2 server (defaultClickDomain, default https://golink.click) and stores the response text as the 'url' value used by s-content.js to redirect s…	0.0.2
8	Other	high	content.js (line 1)	Implements a coercive blur overlay (z-index 2147483646, full-viewport backdrop-filter blur) covering the destination page after a forced redirect, gating access behind a 'Remove blur' button — and overrides any elemen…	0.0.2
9	Privilege Escalation	high	background.js (line 1)	On install, the service worker iterates over every open tab in the browser and force-injects content scripts via chrome.scripting.executeScript using the <all_urls> host permission. This bypasses the normal content_sc…	0.0.2
10	Unauthorized Data Collection	high	background.js (line 1)	At install time, the extension reads tds.<dcd> cookies via chrome.cookies.getAll, captures the Chrome Web Store referrer query string, the user's height/width, timezone offset, full user agent, navigator.languages, an…	0.0.2
11	Obfuscation	medium	background.js (line 1)	Custom encoding routine that base64-encodes payloads and reverses the resulting string. There is no security purpose — base64+reverse provides no encryption, only obfuscation against static analysis and casual network…	0.0.2
12	Tracking	medium	background.js (line 1)	Registers an uninstall URL that pings the C2 with the user's persistent uuid, utm_partner attribution and dcd hostname when they remove the extension — used to track churn and award affiliate payouts to the partner th…	0.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


chrome.google.com	/webstore	https://chrome.google.com/webstore
golink.click	-	https://golink.click
www.dailymotion.com	/player/metadata/video/$%7Bn%7D	https://www.dailymotion.com/player/metadata/video/${n}?app=com.dailymotion.neon&locale=en&client_type=website`
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	-	https://*
*	-	http://*
http:	-	http://:
https:	-	https://:
vk.com	/al_video.php	https://vk.com/al_video.php?act=show_inline&al=1&video=${e}`,o=new
player.vimeo.com	/video/$%7Bt.id.replace(	https://player.vimeo.com/video/${t.id.replace(

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

Dyah Swinger·8 Aug 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Videogo link

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating