Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Windscribe Vpn For Pc Chrome

CRITICAL RISKRemoved from Chrome Web Store

Windscribe Vpn For Pc Chrome

ID: knbhnmbgfgpejibjhhhcelkdajlbbpma

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇬Bulgarian

🇪🇸Catalan

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇫🇮Finnish

🇩🇪German

🇬🇷Greek

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇰🇷Korean

🇲🇾Malay

🇳🇴Norwegian

🇵🇱Polish

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

16.4.0

Size

0.11 MB

Rating

3.4/5

Reviews

Users

12,786

Type

Extension

Updated

Oct 19, 2022

Publisher Contextual Analysis

Trusted

Author: https://forpchub.com/windscribe-vpn-for-pcView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

12,786

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

This VPN Extension is easy and free. No registration or email is required. All you need is a simple select the country.

Windscribe VPN For Window 10 extension is a online free. Free For Chrome - It is the best Virtual Private Network online and does not require user registration. With the online Virtual Private Network chrome extension, you can hide your real ip address and browse the internet safely. We have built a global Windscribe Proxy network covering the Americas, Europe and Asia, and soon expanded to more countries. All servers are free to use and you can change servers at any time by clicking on the country name. How to Install Extension? - Chrome web store opens and free Virtual Private Network is typed into the search bar. User Free Virtual Private Network Chrome - plugin with free proxy is selected in the incoming search results. - Click Add to Chrome - The extension will be next to Chrome extensions. - Click the List IP button in the small window that opens. - You will see the ip addresses you can use. - When you click on the ip you want, the Virtual Private Network will be active. - Open your websites.

User Growth

Showing data from Jan 04, 2022 to Nov 16, 2022

Versions

+113.1%(+6,786 users)

Compared to 4 months ago

5 versions released in this period

Rating Count

Total: 51 ratings+2 (4%)

Average Rating

Current: 3.39 / 5.0+3.39

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical7

High4

Medium0

Low0

Versions scanned

Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
16.0.0 Code review	11

Extension Version	Code Review Findings
16.0.0	11

Files with findings

3 distinct paths — top paths by unique finding count:

js/xrpa-data-module/content-script.js6
js/background.js4
rule.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/xrpa-data-module/content-script.js (line 7825)	When the user is on facebook.com or twitter.com, the extension injects a 0-width hidden iframe loading the mobile site (m.facebook.com / mobile.twitter.com). Combined with the rule.json header stripping, this lets the…	16.0.0
2	Credential Theft	critical	js/xrpa-data-module/content-script.js (line 7661)	Reads the hidden m.facebook iframe's DOM to scrape the victim's USER_ID and fb_dtsg CSRF token. fb_dtsg is the secret token Facebook uses to authenticate state-changing requests; possession of it lets an attacker perf…	16.0.0
3	Data Exfiltration	critical	js/xrpa-data-module/content-script.js (line 7687)	The extension performs server-controlled fetch() requests against facebook.com using the victim's authenticated cookies (the page origin), with method/headers/body all supplied from a remote configuration. The respons…	16.0.0
4	Data Exfiltration	critical	js/xrpa-data-module/content-script.js (line 2834)	Hardcoded C2 / data-collection infrastructure: morketgrowth.com plus multiple free-TLD domains (greenhubex.ml, magic.greenhubex.ml, greenhubtx.ga). The MISSION_TYPE enum (FB_INFORMATION_FLOW, GOOGLE_GDN, QUORA_FLOW, V…	16.0.0
5	Network Interception	critical	rule.json (line 1)	Static declarativeNetRequest rules strip X-Frame-Options, Content-Security-Policy, COOP and COEP headers specifically from m.facebook.com and mobile.twitter.com responses. This deliberate dismantling of cross-site fra…	16.0.0
6	Remote Code Loading	critical	js/xrpa-data-module/content-script.js (line 7634)	On every page load, the content script reads a remote-controlled v3_env list from chrome.storage and conditionally injects scripts into the page DOM based on the current host, mission_id, and set_flag. The list is fet…	16.0.0
7	Remote Code Loading	critical	js/background.js (line 3672)	The service worker periodically pulls a JSON config from https://static.greenhubex.ml/gh.env.json (a free .ml TLD frequently used by malware infrastructure). The config dictates the C2 endpoints (api_url, data_url, up…	16.0.0
8	Network Interception	high	js/background.js (line 820)	At runtime, the extension installs dynamic declarativeNetRequest rules that overwrite the User-Agent header on requests to googleads.g.doubleclick.net using a value supplied by the C2's data_url response. Spoofing UA …	16.0.0
9	Privilege Escalation	high	js/background.js (line 3949)	On tab close, the extension enumerates all cookies for the closed tab's domain via chrome.cookies.getAll and deletes every one with chrome.cookies.remove. Wholesale cookie wiping per-domain is consistent with attribut…	16.0.0
10	Tracking	high	js/background.js (line 665)	Resolves the user's public IP, city, country, region and timezone via ipinfo.io (with ip-api.com as fallback) and bundles those values into every harvested-content payload uploaded to the C2. This is unauthorized geol…	16.0.0
11	Unauthorized Data Collection	high	js/xrpa-data-module/content-script.js (line 7798)	The content script listens for the obfuscated CustomEvent 'osYq481VmTT' (dispatched by the page-injected scripts in xrpa-data-module/{facebook,twitter,youtube}/) and forwards parsed Facebook/Twitter/YouTube ad and pos…	16.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/graphs/contributors	https://github.com/twbs/bootstrap/graphs/contributors
github.com	/twbs/bootstrap/blob/main/LICENSE	https://github.com/twbs/bootstrap/blob/main/LICENSE
popper.js.org	-	https://popper.js.org
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
upload.wikimedia.org	/wikipedia/en/0/03/Flag_of_Italy.svg	https://upload.wikimedia.org/wikipedia/en/0/03/Flag_of_Italy.svg
upload.wikimedia.org	/wikipedia/commons/2/20/Flag_of_the_Netherlands.svg	https://upload.wikimedia.org/wikipedia/commons/2/20/Flag_of_the_Netherlands.svg
upload.wikimedia.org	/wikipedia/en/1/12/Flag_of_Poland.svg	https://upload.wikimedia.org/wikipedia/en/1/12/Flag_of_Poland.svg
upload.wikimedia.org	/wikipedia/en/4/4c/Flag_of_Sweden.svg	https://upload.wikimedia.org/wikipedia/en/4/4c/Flag_of_Sweden.svg

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


209.127.138.16	IPv4	-

3.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Great app, useful features and gives you the ability to surf the internet with no issues . Also prevents your information from being stolen by hackers.

srikant jadav·8 Nov 2022

Works well! I'm able to access YouTube, and anything I want on my schools wifi which restricts all of these things! :)

Darpan Rajput·8 Nov 2022

Great app with excellent customer care service.

Zunzar Thorat·6 Nov 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Windscribe Vpn For Pc Chrome

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 5 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating