Is Emoji keyboard online - copy&past your emoji. safe?

Analysis summary

Summary:
The "Emoji Keyboard Online" extension, designed to facilitate emoji insertion, is confirmed to be part of a malicious campaign, engaging in covert data harvesting and browser hijacking activities.

Key insights:

Intended for enhancing online communication by providing easy access to emojis.
Rated Critical due to confirmed spyware activity and involvement in a known malicious campaign.
Exhibits malicious behavior by intercepting browsing activity and exfiltrating sensitive data to attacker-controlled servers.
Leverages broad host permissions to interact with all websites, exceeding its declared emoji-related functionality.
Poses significant risk to user privacy, browser integrity, and organizational security by facilitating unauthorized data collection and potential credential theft.

Malware versions

0.1.6.6

Now Viewing

malware

Findings

Associated with Malicious Campaign

Flags items that have been linked to known malicious campaigns based on threat intelligence or prior incidents. Indicates coordinated activity with intent to compromise, deceive, or exploit users.

critical

Spyware Activity

Flags items that secretly collect user or device information without authorization.

critical

Malicious Activity Detected

Flags items that exhibit confirmed malicious activity.

critical

Evidence

While appearing functional, this extension hijacks the browser by intercepting tab updates, exfiltrating visited URLs to a threat actor’s command-and-control server, and redirecting users to phishing or malware sites. This behavior enables persistent surveillance, credential theft, and full account compromise.

All findings are available for Enterprise users

Code analysis

AI-powered analysis of the extension's source code for security insights and risk assessment.

Code Functionality Overview
- Event Listeners: The code sets up two main event listeners using the Chrome Extensions API:
  - onInstalled: This listener triggers when the extension is installed or updated. It removes existing rules and adds a rule that shows the page action when the page state matches certain conditions.
  - onMessage: Listens for messages sent to the extension. Specifically, it looks for messages of type "get-ad-links" containing a URL.
- Fetch Request: Upon receiving a valid message, the code constructs a POST request to https://admitab.com/api, which includes an API key and the encoded URL received from the message. This indicates a request for ad links related to the provided URL.
- Response Handling: The response from the fetch request is processed, with the code checking if it starts with "http". If a valid response URL is returned, it is sent back through the message channel. If the response starts with "nt:", a new tab is opened with the specified URL. If there is an error, a false value is returned.
Potential Malicious Behavior
- API Key Exposure: The hardcoded API key within the fetch request can indicate potential malicious behavior, as it may provide unauthorized access to an external service, potentially leading to data leakage or security vulnerabilities.
- Fetching External Content: The use of fetch to make requests to an external URL (admitab.com) can be considered suspicious, especially if it is for obtaining advertising links without user consent or transparency about the data being sent.
- Dynamic URL Creation: The code's ability to open new tabs with URLs derived from responses (especially those starting with "nt:") may lead to malicious redirects or phishing attempts if the received data is manipulated or compromised.

Overall, while the primary functionality appears to be fetching ad links, the presence of the hardcoded API key and the behavior of dynamically handling URLs and opening new tabs raises flags for potential misuse or malicious intent.

Permissions

medium

storage

api

Enables persistent data storage for the extension, potentially storing large amounts of user-related information.

low

declarativeContent

api

Enables taking actions on web pages based on their content without requiring direct content access.

pending

<all_urls>

host

API Calls

API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

API CALLS ARE AVAILABLE FOR ENTERPRISE USERS

Secrets

Any encoded/decoded secrets we managed to find in the source code, git repository, or related files

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

SECRETS ARE AVAILABLE FOR ENTERPRISE USERS

Vulnerabilities

Known vulnerabilities and security issues detected in the extension's dependencies and code.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

VULNERABILITIES ARE AVAILABLE FOR ENTERPRISE USERS

External communication

Any identifiers we detected that may indicate external communication from the item's code

https://admitab.com/api?key=1f0779cb684df275454a31c5efe9206759ef2682&allowempty=1&out=

js/bg.js

All external communications are available for Enterprise users

Dependencies

Dependencies and third-party libraries used by the extension, including version information and license details.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

DEPENDENCIES ARE AVAILABLE FOR ENTERPRISE USERS

Licenses & Compliance

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

LICENSES & COMPLIANCE ARE AVAILABLE FOR ENTERPRISE USERS