Attributed metadata history

Analysis of an advanced malicious Chrome extension

Two weeks ago I published an article on 63 malicious Chrome extensions. In most cases I could only identify the extensions as malicious. With large parts of their logic being downloaded from some web servers, it wasn’t possible to analyze their functionality in detail. However, for the Download Manager Integration Checklist extension I have all parts of the puzzle now. This article is a technical discussion of its functionality that somebody tried very hard to hide. I was also able to identify a number of related extensions that were missing from my previous article. Update (2025-02-04): An update to Download Manager Integration Checklist extension has been released a day before I published this article, clearly prompted by me asking adindex about this. The update removes the malicious functionality and clears extension storage. Luckily, I’ve saved both the previous version and its storage contents. Contents The problematic extensions “Remote configuration” functionality The code being executed The “session” handling Who is behind these extensions? The problematic extensions Since my previous article I found a bunch more extensions with malicious functionality that is almost identical to Download Manager Integration Checklist. The extension Auto Resolution Quality for YouTube™ does not seem to be malicious (yet?) but shares many remarkable oddities with the other extensions. Name Weekly active users Extension ID Featured Freemybrowser 10,000 bibmocmlcdhadgblaekimealfcnafgfn ✓ AutoHD for Twitch™ 195 didbenpmfaidkhohcliedfmgbepkakam Free simple Adult Blocker with password 1,000 fgfoepffhjiinifbddlalpiamnfkdnim Convert PDF to JPEG/PNG 20,000 fkbmahbmakfabmbbjepgldgodbphahgc Download Manager Integration Checklist 70,000 ghkcpcihdonjljjddkmjccibagkjohpi ✓ Auto Resolution Quality for YouTube™ 223 hdangknebhddccoocjodjkbgbbedeaam Adblock.mx - Adblock for Chrome 1,000 hmaeodbfmgikoddffcfoedogkkiifhfe ✓ Auto Quality for YouTube™ 100,000 iaddfgegjgjelgkanamleadckkpnjpjc Anti phising safer browsing for chrome 7,000 jkokgpghakemlglpcdajghjjgliaamgc ✓ Darktheme for google translate 40,000 nmcamjpjiefpjagnjmkedchjkmedadhc ✓ Additional IOCs: adblock[.]mx adultblocker[.]org autohd[.]org autoresolutionquality[.]com browserguard[.]net freemybrowser[.]com freepdfconversion[.]com internetdownloadmanager[.]top megaxt[.]com darkmode[.]site “Remote configuration” functionality The Download Manager Integration Checklist extension was an odd one on the list in my previous article. It has very minimal functionality: it’s merely supposed to display a set of instructions. This is a task that doesn’t require any permissions at all, yet the extension requests access to all websites and declarativeNetRequest permission. Apparently, nobody noticed this inconsistency so far. Looking at the extension code, there is another oddity. The checklist displayed by the extension is downloaded from Firebase, Google’s online database. Yet there is also a download from https://help.internetdownloadmanager.top/checklist, with the response being handled by this function: async function u(l) { await chrome.storage.local.set({ checklist: l }); await chrome.declarativeNetRequest.updateDynamicRules({ addRules: l.list.add, removeRuleIds: l.list.rm, }); } This is what I flagged as mali

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.