Chrome Web StoreCaution required
Suspicious in code review (v7.4.3.55)
Our reviewer found behaviour consistent with malware in version 7.4.3.55, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
What our analysis found
Zapbase is rated caution by Extension Auditor. Our code review reported 3 findings (1 critical, 2 high), led by remote code loading. It comes from a publisher with 20 extensions and was last updated in October 2026.
Key findings
- Critical
Remote Code Loading
Every 10 minutes (alarm 'Ten_Minutes', line 240) the extension fetches a JSON payload from the remote server [domain withheld] and forwards the entire response object to the WhatsApp Web content script as 'Update_DomSelector'. The remote server can modify the object's contents at any time without a CWS update, effectively enabling server-side control of content-script behaviour. The response also contains a 'remote_code' field (extracted at line 378) that points to additional remote assets, extending the attack surface beyond simple config updates.
- High
Credential Theft
At install time, the extension queries all open Chrome Web Store tabs, extracts a 'bearer_token' query parameter from their URLs (line 136), and opens WhatsApp Web as [domain withheld]} (line 109). The same navigation is triggered by external messages from [domain withheld] (externally_connectable, line 57 manifest). Appending an opaque token to the WhatsApp URL is the documented WaSteal credential-injection vector: the content script can read this URL parameter and relay it to the remote backend to authenticate against the victim's WhatsApp session.
- High
Other
The extension registers an external message listener that accepts commands from [domain withheld] and [domain withheld] (manifest externally_connectable). The 'user_auth' action navigates WhatsApp to a URL embedding the caller-supplied bearer_token and can close the originating tab (removing the evidence tab from the victim's browser). This allows the remote operator's web application to trigger WhatsApp session injection at will, without any user interaction after the extension is installed.
Analyst notes
The extension has been independently flagged as "WaSteal" by [domain withheld] (IoC added 2026-05-13). Source code confirms two WaSteal-consistent mechanisms: (1) fetches a config payload from [domain withheld] every 10 minutes (line 183) and pushes the full response object — including a 'remote_code' URL — to the WhatsApp Web content script via Update_DomSelector, enabling the remote server to alter content-script behavior without a CWS update; (2) at install time, reads a bearer_token from the Chrome Web Store tab URL (line 136) and navigates WhatsApp to [domain withheld]} (line 109), a credential-passing channel exploitable for session hijacking. The extracted bundle accounts for only 19 of the ~400 files the ML features imply; the specific file that imports (v_7_4_3_55_...) is absent from the bundle, suggesting the main content-script payload is loaded at runtime from the remote server. The 93% malicious permhash cluster corroborates the ML signal; publisher reputation ( other extensions malicious) is the primary mitigating factor but does not outweigh the IoC and confirmed code patterns.
Zapbase Chrome extension security report
ID: pldfelebkfalpldhfbeagfgmmmelajlc
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- ewdht
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Email Change History
Screenshots & videos
Install growth
About this extension
Zapbase é um CRM para WhatsApp Web. Organize seus chats e otimize seus negócios no WhatsApp Web
Read the publisher’s full description
Com novas funcionalidades para whatsapp web, você pode ter mais controle sobre seus leads além de prospectar mais clientes com envios em massa e exportação de contatos na Zapbase. Crie um verdadeiro funil de CRM para vender mais. Características: ✔ Envio em massa para seus contatos ou contatos importados por csv ✔ Crie Abas personalizadas, encontre facilmente seus contatos importantes Visão Kanban dos contatos do whatsapp organize seus leads ✔ Envie mensagens para um número que não esteja na sua agenda ✔ Crie notas para cada contato dentro do contato ✔ Você tem que ligar de volta? Crie lembretes para cada contato ✔ Agende Reuniões no google agenda direto do seu whatsapp ✔ Crie lembretes de forma simples e seja notificado no seu próprio whatsapp web ✔ Crie um banco de respostas rápidas para enviar com um clique ✔ Exporte todos seus contatos do whatsapp ou contatos de grupos de wpp ✔ Use em seu idioma nativo (português, espanhol, inglês) ✔ Borre as mensagens do seu whatsapp web para criar vídeos tutorias ✔ Assistente AI — Sua inteligência artificial pronta para ajudar! Otimize seu tempo com um assistente inteligente, rápido e sempre disponível. Responda dúvidas, automatize tarefas, gere textos, traduções e muito mais com o poder da IA. Ideal para profissionais, equipes e quem busca praticidade no dia a dia. Importante: ✔ Aprovado na auditoria de segurança do Google Chrome ✔ Não usa banco de dados, tudo acontece no seu computador. Zapbase é uma extensão independente do Chrome que adiciona recursos extras ao seu WhatsApp web, não fazemos parte do WhatsApp Inc., não temos contrato de uso ou licenças exclusivas. WhatsApp é a marca registrada da WhatsApp Inc.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from ewdht
Popular in Tools
- Claude20,000,000 users
- Zotero Connector9,000,000 users
- ChatGPT8,000,000 users
- Browsec VPN - Free VPN for Chrome8,000,000 users
- WPS PDF - Read, Edit, Fill, Convert, and AI Chat PDF with Ease7,000,000 users