Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: WAToolkit

CRITICAL RISKRemoved from Chrome Web Store

WAToolkit

ID: fedimamkpgiemhacbdhkkaihgofncola

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

3.0.3

Size

0.03 MB

Rating

4.6/5

Reviews

4,048

Users

40,000

Type

Extension

Updated

Jul 4, 2024

Publisher Contextual Analysis

Author: watoolkitView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

40,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

A set of useful and lightweight tools for WhatsApp™ Web client.

★★★★★ WATookit is a useful extension for WhatsApp™ Web! Never ever miss a WhatsApp notification again while you are on your desktop computer. This extension makes it possible to receive WhatsApp notifications even when there is no WhatsApp tab or Chrome window at all open. This way you will never miss a message again while working on your PC. ———————————————————— FEATURES ———————————————————— ★ Enables always-on desktop notifications: Chrome will run in background mode permanently, keeping track and showing your WhatsApp notifications instantly. You can click on the notifications to go directly to the relevant chat. ★ Adds a convenient WhatsApp button to the toolbar: It includes the number of unread messages always visible. You can hover the mouse over the icon and you will see a summary of your unread conversations in a tooltip. In addition, the icon will become orange if there's some kind of connectivity issue with your phone. You can still hide the button if you want, just right click on it and select "Hide button". ★ Ensures you only have one instance of WhatsApp Web open at any time: That way you can focus on the right tab in any situation. Moreover, you won't be bothered with WhatsApp's exit confirmation messages any more. ★ Extremely lightweight and fast: Coded with performance in mind. ———————————————————— FREQUENT QUESTIONS ———————————————————— • How to use it? To start using WhatsApp Web, install this extension and click on the Chrome toolbar button with the "T" icon. If you are not logged in to WhatsApp Web, you must follow the instructions and scan the QR code with your phone. Remember to check the "Keep me signed in" checkbox so that your session is not closed automatically, or you may miss notifications. • I cannot see any notification, what's happening? If the toolbar "T" icon is orange, there might be some connectivity issue with your phone. If you still cannot see WhatsApp notifications, please refer to the official support thread to solve the issue: http://www.whatsapp.com/faq/web/28080004 ———————————————————— LICENSE ———————————————————— WAToolkit is free and open source. The source code is released under The GNU General Public License v3.0. ———————————————————— LEGAL ———————————————————— WhatsApp is a trademark of WhatsApp Inc., registered in the U.S. and other countries. WAToolkit is an independent project and has no relationship to WhatsApp or WhatsApp Inc.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 4,072 ratings

Average Rating

Current: 4.62 / 5.0-0.02

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High2

Medium2

Low0

Versions scanned

Showing 1 of 9 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.0.2 Code review	8

Extension Version	Code Review Findings
3.0.2	8

Files with findings

2 distinct paths — top paths by unique finding count:

static/background/index.js7
script.7e77ec77.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	static/background/index.js (line 252)	Executes scripts in the page's MAIN world via chrome.scripting.executeScript and interprets the returned `{m, f, a}` object as an instruction to walk a property path (`m`), locate a function name (`f`), and invoke it …	3.0.2
2	Network Interception	critical	static/background/index.js (line 290)	Uses declarativeNetRequest to set the Content-Security-Policy response header to an empty string on main_frame and sub_frame responses for URLs supplied by the remote `_cfg`. Stripping CSP on third-party sites defeats…	3.0.2
3	Privilege Escalation	critical	static/background/index.js (line 315)	On every tab navigation and every network request across <all_urls>, the extension extracts the host via a server-supplied regex (`a.eh`), hashes it with the djb2-style function `w`, and checks it against a server-sup…	3.0.2
4	Remote Code Loading	critical	static/background/index.js (line 172)	On install and on a configurable alarm interval, the background service worker POSTs to an attacker-controlled endpoint (watoolkit.com) and stores the returned JSON as `_cfg` in chrome.storage.local. The config drives…	3.0.2
5	Code Injection	high	static/background/index.js (line 225)	The payload function injected into the page MAIN world walks a property chain (`cfg.values`) to resolve a function reference at runtime and invokes it with config-driven arguments. Using server-controlled property pat…	3.0.2
6	Obfuscation	high	static/background/index.js (line 214)	djb2-style string hash used to compare visited hostnames against the server-provided allowlist `a.h`, and a regex helper that consumes server-provided patterns (`a.eh`) to extract the match. The use of hashed hostname…	3.0.2
7	Other	medium	script.7e77ec77.js (line 146)	Injects an inline <script> into the WhatsApp page that nulls `window.onbeforeunload`, suppressing navigation-away prompts. This silently disables a user-protection mechanism and pairs poorly with the background script…	3.0.2
8	Privilege Escalation	medium	static/background/index.js (line 82)	Automatically closes other WhatsApp Web tabs on extension load/install and opens a new one, and clears `document.body.innerHTML` in certain cases. Aggressive tab takeover and DOM wiping of whatsapp.com is abnormal beh…	3.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
web.whatsapp.com	-	https://web.whatsapp.com/
chrome.google.com	/webstore/detail/watoolkit/fedimamkpgiemhacbdhkkaihgofncola/reviews	https://chrome.google.com/webstore/detail/watoolkit/fedimamkpgiemhacbdhkkaihgofncola/reviews
watoolkit.com	-	https://watoolkit.com/

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

I can't imagine browsing without this extension anymore. It's become like second nature to me. And speaking of essentials, ReplyPal is right up there with it. These two are my go-to extensions, ones I make sure to have wherever I'm browsing.

Brittni Milete·18 Feb 2024

This garbage is used by third parties and modify few things in your Internet without notification. Definitely is not what you want to have in your tools if you want security and privacy.

Rudi Gonzalez·20 Sept 2023

This garbage is used by third parties and modify few things in your Internet without notification. Definitely is not what you want to have in your tools if you want security and privacy.

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

WAToolkit

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 9 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating