What our analysis found

Wa Elo IA is rated caution by Extension Auditor. Our code review reported 2 findings (2 medium), led by remote code loading. It comes from a publisher with 51 extensions and was last updated in September 2026.

Key findings

• medium· remote code loading —Every 10 minutes the background service-worker GETs ` and forwards the entire server response to the WhatsApp content script via the 'Update_DomSelector' message. This creates a persistent remote-control channel: the operator can change how the content script processes WhatsApp DOM elements (contacts, messages, phone numbers) without publishing a new extension version. The field name `remote_code` and the 'inject-code' handler that triggers the same function reinforce that this serves as a dynamic delivery mechanism, not just static configuration.
• medium· other —On install the extension silently closes existing WhatsApp and Chrome Web Store tabs, then scrapes a `bearer_token` URL parameter from any open tab and re-opens WhatsApp with that token appended to the URL (`). While this appears to be an SSO mechanism for the publisher's CRM login flow ( redirects back to CWS with the token), the pattern of reading auth tokens from third-party Google tabs and injecting them into another first-party page's URL context is architecturally risky: any compromise of the ` ` auth flow or the config server could turn this into a session-token harvesting channel. This alone is not conclusive but amplifies the remote-control risk described in finding 1.

The extension is a WhatsApp CRM tool (Wa Elo IA / Watidy) with plausible legitimate functionality, but three corroborating signals prevent clearance. First, ` ` fetches a remote config from ` every 10 minutes (Ten_Minutes alarm) and forwards the entire server response to the WhatsApp content script as 'Update_DomSelector' — a persistent server-side behavior-control channel named with a variable 'remote_code' that the 'inject-code' message handler calls, strongly implying server-pushed selector or code updates. Second, an internal IoC explicitly flags this extension as 'WaSteal' (, added 2026-05-13), corroborated by a 93% malicious permhash cluster of 16,776 peers with the identical permission set. Third, the extraction bundle contains only 19 of 317+ JS files (per ML evidence totals); the main content script (`v_7_4_3_55_... `) imported by ` ` is absent from the bundle entirely, making it impossible to confirm or deny actual data exfiltration. The publisher's 41 other extensions show 0% malicious and all network endpoints are on the publisher's own ` ` domain, which partially supports the CRM narrative; the bearer-token-via-URL pattern is a legitimate cross-context SSO mechanism for the CRM login flow. However, the missing content script, the named IoC, the email-change signal, and the remote-control config channel together rise above a simple false positive.