Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: WhatsGreen Multi Messenger

CRITICAL RISKRemoved from Chrome Web Store

WhatsGreen Multi Messenger

ID: emipoepfakonicaobeeejombhfkbicld

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.0.1

Size

0.13 MB

Rating

4.4/5

Reviews

789

Users

475,368

Type

Extension

Updated

Aug 30, 2020

Publisher Contextual Analysis

Author: http://whatsgreen.orgView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

475,368

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Easy access to WhatsApp, Line, Telegram, FB Messenger and many more from the Chrome toolbar.

Meet Green Multi Messenger - an ultimative Messenger, which supports all the mainstream worldwide chats and messengers. Leave jumping from chat to chat and switching between WhatsApp and FB Messenger in the past - one app brings all the communication power to your browser and it's called WhatsGreen. Easy access to WhatsApp, Telegram, Hangout, Skype, Messenger and other message applications via Chrome toolbar. Green Multi Messenger is the easiest way to chat with friends from Chrome Browser without a phone. With Green Multi Messenger you will never miss a message again while working on your PC. Instead of checking phone every time, Multi Messenger is a fast way to send and read messages from most popular apps. During your surfing the web and opening other web pages, simply click to the extension button and window chat will be show on the current page. Green Multi Messenger is an irreplaceable assistant with: - Support desktop notifications, so you will be always notified about new messages even when you aren’t checking the web page. - Fast Launch for popular messengers.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High6

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.1 Code review	12

Extension Version	Code Review Findings
1.0.1	12

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js9
js/analytics.js2
js/whatsapp_content.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/analytics.js (line 1)	analytics.js is injected as a content script into every page the user visits (<all_urls>). Beyond loading Mixpanel with a server-controlled token, it iterates over `d.var` — a server-controlled key-value map — and ass…	1.0.1
2	Network Interception	critical	js/background.js (line 1)	The proxy() method intercepts ALL main-frame navigation requests via webRequest.onBeforeRequest and silently redirects them through a server-controlled proxy (proxyUrl/proxyKey fetched remotely). It first fetches a 'c…	1.0.1
3	Network Interception	critical	js/background.js (line 1)	The enableIframeAccess() method uses a blocking webRequest listener on <all_urls> to strip four critical security response headers — x-frame-options, content-security-policy, x-content-security-policy, and strict-tran…	1.0.1
4	Remote Code Loading	critical	js/background.js (line 1)	The updateConfig() method polls `https://whatsgreen.org/api/config/` every 15 minutes (900 000 ms), sending the extension ID, version, install duration, and a persistent UID, and applies whatever JSON the server retur…	1.0.1
5	Tracking	critical	js/background.js (line 1)	The InitStat() method registers a webRequest.onCompleted listener on all main-frame navigations. For every unique domain the user visits, it fires an XHR to a server-controlled affiliate URL template (`aff_url_tmpl`) …	1.0.1
6	Data Exfiltration	high	js/background.js (line 1)	The processQueue() method encodes extension install/update events as base64 JSON (using btoa) containing the extension ID, version, a persistent user UID, and a timestamp, then POSTs this to `https://whatsgreen.org/ap…	1.0.1
7	Network Interception	high	js/background.js (line 1)	The filterRequests() method attaches a blocking webRequest listener that strips any response headers named in the server-supplied `validateFields` array from every HTTP response across all URLs. Because `validateField…	1.0.1
8	Obfuscation	high	js/background.js (line 1)	checkBgConsole() exploits a well-known DevTools detection trick: it overrides the toString() method of a regex and passes it to console.log with a CSS formatter — if DevTools is open, the formatter calls toString() an…	1.0.1
9	Obfuscation	high	js/analytics.js (line 1)	analytics.js contains the same DevTools detection evasion technique as background.js, but deployed as a content script. When the server sets `checkOptPattern` and `checkPattern` (a regex applied to the current page UR…	1.0.1
10	Tracking	high	js/background.js (line 1)	When statProcessor mode is 'on', this blocking webRequest listener extracts the value of a server-specified header from outgoing requests, removes that header, then overwrites the Accept header with the extracted valu…	1.0.1
11	Unauthorized Data Collection	high	js/background.js (line 1)	detectExtentionById() creates a silent background tab pointing to another extension's manifest.json and attempts to inject CSS into it; a specific error message pattern is used to infer whether the extension is instal…	1.0.1
12	Code Injection	medium	js/whatsapp_content.js (line 1)	When the WhatsApp Web page URL contains the string 'unregister-sw', this content script injects an inline script element that programmatically unregisters the WhatsApp service worker. Service workers handle offline ca…	1.0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
ssl.google-analytics.com;	-	https://ssl.google-analytics.com;
whatsgreen.org	/api/actions/	https://whatsgreen.org/api/actions/
whatsgreen.org	/uninstall/	https://whatsgreen.org/uninstall/
whatsgreen.org	/StartAI1/	https://whatsgreen.org/StartAI1/
chrome.google.com	/webstore/detail/whatschrome-extension/kbhfoiaobflocffnclkigpkeoagheimn/reviews	https://chrome.google.com/webstore/detail/whatschrome-extension/kbhfoiaobflocffnclkigpkeoagheimn/reviews
whatsgreen.org	/new_launcher/	https://whatsgreen.org/new_launcher/
web.whatsapp.com	-	https://web.whatsapp.com
messenger.com	-	https://messenger.com
timeline.line.me	-	https://timeline.line.me

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

I can not find the app I downloaded and God bless you and stay safe during Covid-19

Aliyah Determan·15 Feb 2021

I really liked it. It helped me a lot.

Anushka Rohilla·9 Feb 2021

Funziona molto bene lo consiglio

Alex de lazzer·8 Feb 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

WhatsGreen Multi Messenger

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews