Attributed metadata history
Up to 100 retained publisher events per page for 20ddb0e7eb50daea4619996beadd235dddd272d36d944a0237a10090b33d1f79. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_ad89769b9e64591ab5
observed · 2026-10-12 14:01:03 UTC
available
Fingerprint: 05d146f940ea021a0ff67bda626eeffcdf1f2ccbc0f3c3114fff19b0a80eeaf4
intelligence_src_ad89769b9e64591ab5
observed · 2026-10-12 14:01:03 UTC
Two weeks ago I published an article on 63 malicious Chrome extensions. In most cases I could only identify the extensions as malicious. With large parts of their logic being downloaded from some web servers, it wasn’t possible to analyze their functionality in detail. However, for the Download Manager Integration Checklist extension I have all parts of the puzzle now. This article is a technical discussion of its functionality that somebody tried very hard to hide. I was also able to identify a number of related extensions that were missing from my previous article. Update (2025-02-04): An update to Download Manager Integration Checklist extension has been released a day before I published this article, clearly prompted by me asking adindex about this. The update removes the malicious functionality and clears extension storage. Luckily, I’ve saved both the previous version and its storage contents. Contents The problematic extensions “Remote configuration” functionality The code being executed The “session” handling Who is behind these extensions? The problematic extensions Since my previous article I found a bunch more extensions w
Fingerprint: c889b3e95980bbe3adbc8f73f99f30296e3052fc45181f31b1650349b0b7b83c