Hostile ^92% chrome 66 installs Download

Refreshplus 1.1.47

CAPTCHA solver, cookie theft, evasion

“This extension is to show and notify updates from the page information.”

Extension sends CAPTCHA tasks to remote solver APIActiveXObject constructor reference

SHA-256be553f5f6d83e3237f6ac61a3651fb0247b42ade5c68534ca50588f0bc57bcb3

URLhttps://clients2.google.com/service/update2/crx?response=redirect&prodversion=131.0&acceptformat=crx3&x=id%3Djloknfpaabefpglkbogljeoficgpnacg%26installsource%3Dondemand%26uc

MaleculeK(Li₃)O₆(ErAs₅CCoIS)H₉(Br₄₀Cm₃₂CrDb₂₆Hf₃Os₇Po₈Ti₃U₁₃)Md₄(InPm₈)

Evidence

Builds characters with String.fromCharCode content_scripts2.js · lines 10–21

⋯5 lines
15
16    function fixedFromCharCode(e) {
17        return 65535 < e ? (e -= 65536, String.fromCharCode(55296 + (e >> 10), 56320 + (e & 1023))) : String.fromCharCode(e)
18    }
19
20    function code(e, t, n) {
21        for (var r = "", a = 0; a < e.length; a++) var i = fixedCharCodeAt(e, a) + fixedCharCodeAt(t, a % t.l …

Creates external CAPTCHA solver task content_scripts2.js · lines 8624–8627

20… etSoftId(802);
              var S = !n[u].is_enterprise ? x.createTaskProxyless : x.createRecaptchaV2EnterpriseTaskProxyless;
              if (e.solve_proxy_on_tasks) {
                  x.setProxyType(e.user_proxy_proto …

CAPTCHA solver service endpoint content_scripts2.js · line 10364

10364:5859…                                                        <a href="https://anti-captcha.com/apidoc/task-types/ImageToTextTask"                                        title="More info about image options read here"         …

Chrome extension manifest file manifest.json · lines 1–13

1{
2"update_url": "https://clients2.google.com/service/update2/crx",
3
4    "name": "Refreshplus",
5    "version": "1.1.47",
6    "description": "Refreshes page and notifies of update with changes in certain sites",
7    "manifest_version": 3,
8    "default_locale": "en",
9    "icons": {
⋯4 lines

Content script targets all web origins manifest.json · lines 16–46

38… ml"
  },
  "options_page": "recaptcha_options.html",
  "permissions": [
      "activeTab",
      "tabs",
⋯4 lines
      "identity.email",
      "alarms",
      "cookies",
      "notifications"
  ],
  "background": {
      "service_worker": "js/service_worker.js"
  },
  "action": {
      "default_icon": "img/icon-48x48.png",
      "default_popup": "index.html"
  },
  "content_scripts": [
      {
          "matches": ["https://www.stubhub.com/*"],
          "run_at": "document_start",
          "js": ["assets/code_stubhub.js"]
      },
      {
          "matches": [
              "h …

Showing the top 5 files — 8 more files (465 regions) not shown.

No evidence locations were recorded for this file. Raw result