Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Web Results for Chrome™

CRITICAL RISKRemoved from Chrome Web Store

Web Results for Chrome™

ID: gpghebehjahceknfdcfifeifhdbongld

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.2.3849

Size

0.66 MB

Rating

4.2/5

Reviews

Users

100,000

Type

Extension

Updated

May 3, 2025

Publisher Contextual Analysis

Author: https://wiseghostapp.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

760,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Find out more about the websites you search for. With Ghost protection.

Get Wise Ghost Web Results to more your online searching safer. 👻 Check if the websites you search are safe - Ghost will help you understand whether a website you clicked on from a search results page is safe or not with a security rating and a quick security check. Make sure to follow the encryption marker so you don’t pass information over unencrypted connections. Find out which trackers are present on the websites you visit. Increasing your awareness is the first step to online safety. There's no need to worry about online privacy and security. Get a friendly ghost to do all the hard work for you! The extension changes your default search engine to 'search.wiseghostapp.com' for enhanced security. Searches will go through our security engine for scanning, and the search results are powered by Bing. For any questions, please contact us at [email protected]

User Growth

Showing data from Jan 17, 2024 to Jan 15, 2025

Versions

No change in user count

Compared to 4 months ago

2 versions released in this period

Rating Count

Total: 14 ratings

Average Rating

Current: 4.21 / 5.0+0.13

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High6

Medium3

Low0

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.1257 Code review	11

Extension Version	Code Review Findings
1.2.1257	11

Files with findings

3 distinct paths — top paths by unique finding count:

background.js9
ghostKA.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 3726)	A generic DOM-manipulation harness is injected into arbitrary tabs via `chrome.scripting.executeScript`. It accepts postMessage-RPC commands to create DOM elements via `innerHTML`, rewrite elements via `outerHTML`, re…	1.2.1257
2	Network Interception	critical	background.js (line 2489)	A remote server-provided `net_conf` delivers regex patterns plus a `redUrl` template; when a tab's URL matches, the extension rewrites it via `chrome.tabs.update(tabId, {url: redUrl})`. This is a server-controlled tra…	1.2.1257
3	Credential Theft	high	background.js (line 2063)	Wraps `chrome.cookies.getAll` with no URL filter (reads every cookie for every site) and `chrome.cookies.set` with a max-int expiration date that persists until year 2038. Combined with the XOR-encoded POST channel th…	1.2.1257
4	Data Exfiltration	high	background.js (line 606)	Hard-coded exfiltration endpoints to two separate domains (`ext.wiseghostapp.com` and `ext.ghostsapp.com`) used as primary/fallback C2 channels, with fixed `/srv/sec/message` and `/srv/sec/uninstall` paths. The `apiDo…	1.2.1257
5	Network Interception	high	background.js (line 5643)	webRequest hooks register on <all_urls> across main_frame, sub_frame, stylesheet, script, image, xmlhttprequest, etc., with `extraHeaders` opt-in to read request and response headers including cross-origin ones. This …	1.2.1257
6	Obfuscation	high	background.js (line 1735)	Outbound POST bodies and inbound responses are encoded with a single-byte XOR cipher (key = 255) then base64, and sent with a fake `application/x-binary` content-type. This is deliberate traffic obfuscation intended t…	1.2.1257
7	Tracking	high	ghostKA.js (line 47)	The content script is injected into every page (<all_urls>) and establishes a keep-alive beacon. On connection failure it sends the hostname of every website the user visits via a pixel request (`new Image`) to `ext.w…	1.2.1257
8	Tracking	high	manifest.json (line 34)	The extension forcibly installs itself as the default search provider and routes every omnibox query + type-ahead suggestion to `search.wiseghostapp.com` / `ext.wiseghostapp.com`. All user search terms (often containi…	1.2.1257
9	Tracking	medium	background.js (line 8641)	Sets a `setUninstallURL` pointing at `/srv/sec/uninstall?eid=<extensionId>` on the operator's domain so the server is pinged whenever a user removes the extension. This is a persistent-tracking / install-lifecycle tel…	1.2.1257
10	Unauthorized Data Collection	medium	background.js (line 2843)	Extracts the Referer header from every outbound request and stores it keyed by request-id and tab-id. Combined with the `client_side_search` event (line 5598) and the message/ping backend, the Referer chain (inbound l…	1.2.1257
11	Unauthorized Data Collection	medium	background.js (line 6507)	A second, parallel webRequest observer on <all_urls> catalogues every sub-resource request the browser makes, keyed by tab, and keeps a per-tab list of contacted hostnames matched against an embedded 300+ entry tracke…	1.2.1257

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


wiseghostapp.com	-	https://wiseghostapp.com
ext.wiseghostapp.com	-	https://ext.wiseghostapp.com
ext.ghostsapp.com	-	https://ext.ghostsapp.com
wiseghostapp.com	/feedback.html	https://wiseghostapp.com/feedback.html
unknow.com	-	http://unknow.com
ext.wiseghostapp.com	/src/background.js.b0ca6898cf4930916554.map	https://ext.wiseghostapp.com/src/background.js.b0ca6898cf4930916554.map
ext.wiseghostapp.com	/srv/sec/rip	https://ext.wiseghostapp.com/srv/sec/rip
ext.wiseghostapp.com	/src/ghostKA.js.b0ca6898cf4930916554.map	https://ext.wiseghostapp.com/src/ghostKA.js.b0ca6898cf4930916554.map
ext.wiseghostapp.com	/src/style.css.b0ca6898cf4930916554.map*/	https://ext.wiseghostapp.com/src/style.css.b0ca6898cf4930916554.map*/
github.com	/webpack-contrib/style-loader	https://github.com/webpack-contrib/style-loader#insertat

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


88.214.193.98	IPv4	-

4.2 out of 5 · 6 most recent reviews

Text reviews

Positive

Negative

We invite you to join us in our partnership to expand your revenue and grow your chrome extension. Let's explore how we can help you. Learn more at: https://extensionbuysell.com Looking forward to working with you!

Madison Francis·19 Sept 2024

its amazing .

alandra·25 Feb 2023

its amazing .

alandra albury·25 Feb 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Web Results for Chrome™

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating