# 131 Chrome Extensions Found Taking Over Browser Control

In a recent shocking discovery, cybersecurity researchers from the company Socket have uncovered a large-scale spam campaign using **131 fake Chrome extensions**, designed to "bombard" WhatsApp Web by automating mass message sending without user consent. These extensions have been spreading on the Chrome Web Store for at least the past 9 months, affecting about **20,905 active users**.

Although not classic malware, they are classified as high-risk **"spamware"**, seriously violating Google Chrome Web Store's policies on duplicate content and unauthorized messaging. This campaign not only floods WhatsApp with spam but also risks account bans, contact data theft, and spreading scams.

## **Overview**

These extensions are **rebranded clones** of a single WhatsApp Web automation tool, sharing the **same codebase, design, and infrastructure**. They are mainly released by two developer accounts: **"WL Extensão"** (83 extensions) and the variant **"WLExtensao"**, linked to the company **DBX Tecnologia** in Brazil—a white-label program allowing affiliates to rebrand and resell.

They disguise themselves as **CRM tools for WhatsApp**, promising:

* Bulk messaging automation
    
* Scheduled sending
    
* Visual lead and sales funnel management
    
* Customer service organization
    

| **Featured Extension Name** | **Number of Users** | **Developer** |
| --- | --- | --- |
| YouSeller | 10.000 | WL Extensão |
| performancemais | 239 | WL Extensão |
| Botflow | 38 | WL Extensão |
| ZapVende | 32 | WLExtensao |

**Full list of 131 extensions** from the report by Socket (socket.dev/blog).

1. [`gioekliddhmaanejaaigfokghoakbaco`](https://socket.dev/chrome/package/gioekliddhmaanejaaigfokghoakbaco) (WaveZap CRM) — 112 users
    
2. [`ephcniiibhpjpfpopmajlmbbijfjpdde`](https://socket.dev/chrome/package/ephcniiibhpjpfpopmajlmbbijfjpdde) (WaCelery) — users not shown
    
3. [`fbkpechbcdilkoadejmhhamidddhdehc`](https://socket.dev/chrome/package/fbkpechbcdilkoadejmhhamidddhdehc) (Top System) — 18 users
    
4. [`ehdekncpobdjejklgpgnjgddjdnblmei`](https://socket.dev/chrome/package/ehdekncpobdjejklgpgnjgddjdnblmei) (Botflow) — 35 users
    
5. [`mnbdaobmkdglnmiagimcniebbgebabek`](https://socket.dev/chrome/package/mnbdaobmkdglnmiagimcniebbgebabek) (Organize-C) — 5,000 users
    
6. [`jelgokpkjcplgcckfiaddlfaaepohfdi`](https://socket.dev/chrome/package/jelgokpkjcplgcckfiaddlfaaepohfdi) (FQ Sales CRM) — 30 users
    
7. [`pmnkmmlmbnalnbgidejbcaigahodcppn`](https://socket.dev/chrome/package/pmnkmmlmbnalnbgidejbcaigahodcppn) (Nexus CRM) — 23 users
    
8. [`ipaoladdllekkdokdnemkpjfllbgplek`](https://socket.dev/chrome/package/ipaoladdllekkdokdnemkpjfllbgplek) (FLEXZAP) — 71 users
    
9. [`gmdnikelbimgeamkdhpdblmeekpojeei`](https://socket.dev/chrome/package/gmdnikelbimgeamkdhpdblmeekpojeei) (BoostChat) — 6 users
    
10. [`lbnhlbjmibbmogaefkppniejgaadimdb`](https://socket.dev/chrome/package/lbnhlbjmibbmogaefkppniejgaadimdb) (WaZap) — 104 users
    
11. [`gmmcjjpciafncfbggmjhglocogcaomjb`](https://socket.dev/chrome/package/gmmcjjpciafncfbggmjhglocogcaomjb) (Convverso CRM) — 44 users
    
12. [`hjlpccojkgfkamonoaoakgjjlejonefo`](https://socket.dev/chrome/package/hjlpccojkgfkamonoaoakgjjlejonefo) (JuriMind CRM) — 24 users
    
13. [`chkaiafjmlfakkibkhbfgfklfaachmnc`](https://socket.dev/chrome/package/chkaiafjmlfakkibkhbfgfklfaachmnc) (ZapKan) — 31 users
    
14. [`oohihogmmfbinbkgaiglgeabloiehlkk`](https://socket.dev/chrome/package/oohihogmmfbinbkgaiglgeabloiehlkk) (Zap Vende) — 30 users
    
15. [`jgfaobieaananaaahonfomlibhchkndb`](https://socket.dev/chrome/package/jgfaobieaananaaahonfomlibhchkndb) (AngoSeller) — 13 users
    
16. [`jhfdppbgfmmaecdgmboadmkaoifjnfmm`](https://socket.dev/chrome/package/jhfdppbgfmmaecdgmboadmkaoifjnfmm) (Vou Falar) — 4 users
    
17. [`phamkmfigepogfnbkelfmknehfcjjklm`](https://socket.dev/chrome/package/phamkmfigepogfnbkelfmknehfcjjklm) (Chatty Seller) — 23 users
    
18. [`jheebhheaomejiiilhgkambdgagmhfhe`](https://socket.dev/chrome/package/jheebhheaomejiiilhgkambdgagmhfhe) (GFlow Chat) — 33 users
    
19. [`foedfcdeffihcmjibkbaffddbjdmkphi`](https://socket.dev/chrome/package/foedfcdeffihcmjibkbaffddbjdmkphi) (CNW ZAP) — 25 users
    
20. [`jhiknfikchccfkhjbfgiolgjofbnmgkd`](https://socket.dev/chrome/package/jhiknfikchccfkhjbfgiolgjofbnmgkd) (66seller) — users not shown
    
21. [`cbhhipokgmechdbhebbalpckddlnfggm`](https://socket.dev/chrome/package/cbhhipokgmechdbhebbalpckddlnfggm) (Doris CRM) — 19 users
    
22. [`cjdcglineikacjboikmchenneanfegoo`](https://socket.dev/chrome/package/cjdcglineikacjboikmchenneanfegoo) (ZappSeller) — 296 users
    
23. [`jmnajdcdmikociadheoaelpejbmoklpm`](https://socket.dev/chrome/package/jmnajdcdmikociadheoaelpejbmoklpm) (CliQ+) — users not shown
    
24. [`jpfpmealiajnfjmiljnmpiifccfkaimj`](https://socket.dev/chrome/package/jpfpmealiajnfjmiljnmpiifccfkaimj) (À Venda - CRM) — 118 users
    
25. [`mcabhobmhiljmdbdigdkkhmhjieecmne`](https://socket.dev/chrome/package/mcabhobmhiljmdbdigdkkhmhjieecmne) (MkZap) — 19 users
    
26. [`pedngakkndckkgfpbdmfmokokdepekho`](https://socket.dev/chrome/package/pedngakkndckkgfpbdmfmokokdepekho) (WhatSmart CRM) — 208 users
    
27. [`lefiaoknofkoecahieockfmhhklkigng`](https://socket.dev/chrome/package/lefiaoknofkoecahieockfmhhklkigng) (Sanzap) — 32 users
    
28. [`mcjdknfjmchailcpcolfjcogggkjfeij`](https://socket.dev/chrome/package/mcjdknfjmchailcpcolfjcogggkjfeij) (WaGpro) — 112 users
    
29. [`mecaooaegbmnneijdhegohdpcepdbbmk`](https://socket.dev/chrome/package/mecaooaegbmnneijdhegohdpcepdbbmk) (Lexchatbot) — users not shown
    
30. [`mppgfleddoodfifpkjjjdbngnkcfcnde`](https://socket.dev/chrome/package/mppgfleddoodfifpkjjjdbngnkcfcnde) (performancemais) — 241 users
    
31. [`igmalhleeaoclfmfdlepdmfnbipkfdfi`](https://socket.dev/chrome/package/igmalhleeaoclfmfdlepdmfnbipkfdfi) (Merlix) — 3 users
    
32. [`eomlbgjohomgjjigponmbnedpgoegegl`](https://socket.dev/chrome/package/eomlbgjohomgjjigponmbnedpgoegegl) (ChatScript) — 6 users
    
33. [`mgpdpmifcljbddedpajabokdebnaemon`](https://socket.dev/chrome/package/mgpdpmifcljbddedpajabokdebnaemon) (BC ZAP) — 44 users
    
34. [`ofmhnbjohiadaagpeibjlncncllelaoo`](https://socket.dev/chrome/package/ofmhnbjohiadaagpeibjlncncllelaoo) (Speedsflow CRM) — 5 users
    
35. [`ofmoeicegmlaleajnpcbddiaomnfmfkp`](https://socket.dev/chrome/package/ofmoeicegmlaleajnpcbddiaomnfmfkp) (DBX Whats) — 1,000 users
    
36. [`hnimkbcgbhlllkcnphhhnbilkjngpphh`](https://socket.dev/chrome/package/hnimkbcgbhlllkcnphhhnbilkjngpphh) (HGTX Intelligence Starter) — users not shown
    
37. [`chdaaapnpinagdkdmkkoandalpdgikdh`](https://socket.dev/chrome/package/chdaaapnpinagdkdmkkoandalpdgikdh) (Wabin) — 17 users
    
38. [`cijeamgoejpplpdnjhejeeahgkbdndni`](https://socket.dev/chrome/package/cijeamgoejpplpdnjhejeeahgkbdndni) (Zaplyd - CRM) — 449 users
    
39. [`pilfkgcokfmoblofkghajplgdpmejjph`](https://socket.dev/chrome/package/pilfkgcokfmoblofkghajplgdpmejjph) (FleboLeads) — 24 users
    
40. [`pfhinnfbeephmihjjegokhbkaeckdldp`](https://socket.dev/chrome/package/pfhinnfbeephmihjjegokhbkaeckdldp) (Monchat) — 5 users
    
41. [`hpopdnbfeddglbokfbainoglnhhoccpb`](https://socket.dev/chrome/package/hpopdnbfeddglbokfbainoglnhhoccpb) (Zappower) — 29 users
    
42. [`gclllmamoegojkehkkohcfcjdmgikldc`](https://socket.dev/chrome/package/gclllmamoegojkehkkohcfcjdmgikldc) (Converzap) — 7 users
    
43. [`hnnbkomgboilfohfkpfgnlcpalcnangb`](https://socket.dev/chrome/package/hnnbkomgboilfohfkpfgnlcpalcnangb) (Bot Imobiliário) — 50 users
    
44. [`hocidiaogjnnibkadkedncomnglnehjg`](https://socket.dev/chrome/package/hocidiaogjnnibkadkedncomnglnehjg) (Lucra Zap) — users not shown
    
45. [`niimbdmbkndibiabpoolngcjipgndijh`](https://www.notion.so/131-Spamware-Extensions-Targeting-WhatsApp-Flood-Chrome-Web-Store-28c4cb3adfeb80759c4fdfe2cb05e24c?pvs=21) (Donna CRM) — users not shown
    
46. [`okdhkkpmmhinmjipggbfpjbdlckkaemb`](https://socket.dev/chrome/package/okdhkkpmmhinmjipggbfpjbdlckkaemb) (Zaplyn) — users not shown
    
47. [`mjailbbfmgaoojmjfcacffkdjoccggcf`](https://socket.dev/chrome/package/mjailbbfmgaoojmjfcacffkdjoccggcf) (FácilCRM) — 174 users
    
48. [`aippcgffdfgfkihejnjkmkbjoidpemcl`](https://socket.dev/chrome/package/aippcgffdfgfkihejnjkmkbjoidpemcl) (IV-CHAT) — users not shown
    
49. [`bajadmkhmpjaiibgakhdgpgllgnhdocc`](https://socket.dev/chrome/package/bajadmkhmpjaiibgakhdgpgllgnhdocc) (Talk Zap CRM) — 33 users
    
50. [`bmcliihacfhpicjacebpnhliojphelck`](https://socket.dev/chrome/package/bmcliihacfhpicjacebpnhliojphelck) (Sellerwork) — 15 users
    
51. [`mjhdkfgdfcehianhcmjpgpicelgehbbe`](https://socket.dev/chrome/package/mjhdkfgdfcehianhcmjpgpicelgehbbe) (Wazapy) — 4 users
    
52. [`mhcnngbhhpmlahekicpkpammjibamlip`](https://socket.dev/chrome/package/mhcnngbhhpmlahekicpkpammjibamlip) (SALES WHATS) — 213 users
    
53. [`jfcekpbabbijmfpcgnnoaekodnagbffd`](https://socket.dev/chrome/package/jfcekpbabbijmfpcgnnoaekodnagbffd) (Super Chat Boom) — users not shown
    
54. [`ahpcdagejgoffjpnbkhemojogbocbahe`](https://socket.dev/chrome/package/ahpcdagejgoffjpnbkhemojogbocbahe) (ChatAds) — 122 users
    
55. [`mkbjflhgpickfellipdmpcnhkmmdcojl`](https://socket.dev/chrome/package/mkbjflhgpickfellipdmpcnhkmmdcojl) (YouSeller) — 10,000 users
    
56. [`nmnflpdnbpnoojmpmhkkiagmegimlnmm`](https://socket.dev/chrome/package/nmnflpdnbpnoojmpmhkkiagmegimlnmm) (FLOW 5.0) — users not shown
    
57. [`nnmbiaaomdknpkgpklfcekneilkimoal`](https://socket.dev/chrome/package/nnmbiaaomdknpkgpklfcekneilkimoal) (TELEFON CONECTA) — 13 users
    
58. [`bjbdjeijmkjcphbmbiifoeaikbmmgcjp`](https://socket.dev/chrome/package/bjbdjeijmkjcphbmbiifoeaikbmmgcjp) (WA FLASH) — 104 users
    
59. [`kekglidebofmckpkojgbogajflnmhega`](https://socket.dev/chrome/package/kekglidebofmckpkojgbogajflnmhega) (MovvaSe) — users not shown
    
60. [`kfopgoafhfkcpnkiemaldlplpbnengjf`](https://socket.dev/chrome/package/kfopgoafhfkcpnkiemaldlplpbnengjf) (Power Chat) — 25 users
    
61. [`nmimioepofbhnidpmebigbahpckjfmbm`](https://socket.dev/chrome/package/nmimioepofbhnidpmebigbahpckjfmbm) (Chatfunel) — 54 users
    
62. [`clpedhieolcgejlfdnlfadojpaiahlfm`](https://socket.dev/chrome/package/clpedhieolcgejlfdnlfadojpaiahlfm) (VicChat) — users not shown
    
63. [`pmdahofhcbcejdodnmijkhahahegenhi`](https://socket.dev/chrome/package/pmdahofhcbcejdodnmijkhahahegenhi) (INWISE CRM) — 13 users
    
64. [`hhlbnnfmjdoeegpoihgandmppnmfpeib`](https://socket.dev/chrome/package/hhlbnnfmjdoeegpoihgandmppnmfpeib) (ZapForce) — 8 users
    
65. [`jleilnojaafdekbbpighcjlcbmfnifim`](https://socket.dev/chrome/package/jleilnojaafdekbbpighcjlcbmfnifim) (ZapWild - CRM) — users not shown
    
66. [`maopdiomoidladgapokmfggnccpolbol`](https://socket.dev/chrome/package/maopdiomoidladgapokmfggnccpolbol) (WhatsTool) — 27 users
    
67. [`cgcckeanlanlpaflhipplbhichjejgpk`](https://socket.dev/chrome/package/cgcckeanlanlpaflhipplbhichjejgpk) (Lever CRM) — 81 users
    
68. [`kleicpolamoebhoajpbhcbmcihbcfobm`](https://socket.dev/chrome/package/kleicpolamoebhoajpbhcbmcihbcfobm) (Opendoor Solucoes) — users not shown
    
69. [`kmhlbkgpafhoojblcfhnljaaighbejfk`](https://socket.dev/chrome/package/kmhlbkgpafhoojblcfhnljaaighbejfk) (Yconecta Latam) — 9 users
    
70. [`ifhkkkfghpgbelajdcmkbahibfieffkl`](https://socket.dev/chrome/package/ifhkkkfghpgbelajdcmkbahibfieffkl) (Pipe Loom) — users not shown
    
71. [`blpopmcoebhlkolmkjjmplbmlgdhggkk`](https://socket.dev/chrome/package/blpopmcoebhlkolmkjjmplbmlgdhggkk) (Connect Castle Solution) — users not shown
    
72. [`begphlgbbimlphmfbigfjcadjgplglcg`](https://socket.dev/chrome/package/begphlgbbimlphmfbigfjcadjgplglcg) (ATENDO DO ZAP) — 34 users
    
73. [`bmeleciepnphilegegcbfjkoolldigid`](https://socket.dev/chrome/package/bmeleciepnphilegegcbfjkoolldigid) ([**SYS.AO**](http://sys.ao/)) — 23 users
    
74. [`ebmbbmldkfhfambpnegomegconmhcioe`](https://www.notion.so/Eng-Standup-Threat-Analysis-28d4cb3adfeb8097a7b4fd68d02f8196?pvs=21) (Evoluwa) — users not shown
    
75. [`ddmhkpkipjnhlppmcepckfgjbmljmphm`](https://socket.dev/chrome/package/ddmhkpkipjnhlppmcepckfgjbmljmphm) (Maiq) — 7 users
    
76. [`jjopcmgbpnfdehgmbioibahegdmmfipm`](https://socket.dev/chrome/package/jjopcmgbpnfdehgmbioibahegdmmfipm) (Zap4u) — users not shown
    
77. [`hdonddbodcfamjgmdolkgfgidjfmijmj`](https://socket.dev/chrome/package/hdonddbodcfamjgmdolkgfgidjfmijmj) (Evan’s Atende) — 33 users
    
78. [`anoghcdepimhncglcecmgnbchpjfkonp`](https://socket.dev/chrome/package/anoghcdepimhncglcecmgnbchpjfkonp) (MestreZap) — users not shown
    
79. [`oiekdjliebhjpjknfojajhjebgeedhag`](https://socket.dev/chrome/package/oiekdjliebhjpjknfojajhjebgeedhag) (Salesly) — 7 users
    
80. [`ohekppieeepibkebnlilabljmnkffmof`](https://socket.dev/chrome/package/ohekppieeepibkebnlilabljmnkffmof) (ZapLead) — 25 users
    
81. [`ohojiglgbgnhaddfhdbkoclekhghncih`](https://socket.dev/chrome/package/ohojiglgbgnhaddfhdbkoclekhghncih) (Chat Power) — users not shown
    
82. [`ekigeoglcndojhecmojcchlhjkbghnmg`](https://socket.dev/chrome/package/ekigeoglcndojhecmojcchlhjkbghnmg) (FarChat) — 28 users
    
83. [`mlladklbipjfnjgjjbkofonboojklnpo`](https://socket.dev/chrome/package/mlladklbipjfnjgjjbkofonboojklnpo) (idk Converte) — 6 users
    
84. [`edgokehfaihammibdolojeljlccobihi`](https://socket.dev/chrome/package/edgokehfaihammibdolojeljlccobihi) (VEXA INOVAÇÃO) — 2 users
    
85. [`eecbjpnghjlfeanpabnebopncfldgkej`](https://socket.dev/chrome/package/eecbjpnghjlfeanpabnebopncfldgkej) (Polo Lucrativo) — 6 users
    
86. [`namibohbbclnmgbnhegongpbkphhelji`](https://socket.dev/chrome/package/namibohbbclnmgbnhegongpbkphhelji) (Sell Swift) — 5 users
    
87. [`ndilbmjmeggijafdloohkniglleeekff`](https://socket.dev/chrome/package/ndilbmjmeggijafdloohkniglleeekff) (Red Chat) — 12 users
    
88. [`bpinnifebepjjedmficfllcnalhcfgin`](https://socket.dev/chrome/package/bpinnifebepjjedmficfllcnalhcfgin) (Hizi Chat) — users not shown
    
89. [`fkcbkncgbolfiijohpipeobfbopidhlg`](https://socket.dev/chrome/package/fkcbkncgbolfiijohpipeobfbopidhlg) (HBS CONNECT) — users not shown
    
90. [`bcabbcjlfhhffnjjfebenghlgfpfobdg`](https://socket.dev/chrome/package/bcabbcjlfhhffnjjfebenghlgfpfobdg) (EAI MAIS) — users not shown
    
91. [`nfoenldfhfooabacoilpappaoggfmdio`](https://socket.dev/chrome/package/nfoenldfhfooabacoilpappaoggfmdio) (ifteczap CRM) — users not shown
    
92. [`bmfeoaglddjefdcdmnaohgjlanmmddog`](https://socket.dev/chrome/package/bmfeoaglddjefdcdmnaohgjlanmmddog) (ByteZap) — 21 users
    
93. [`mpcajkogkmebocmcflglhmdekfglallb`](https://socket.dev/chrome/package/mpcajkogkmebocmcflglhmdekfglallb) (Cresça & Apareça CRM) — 4 users
    
94. [`ghlcmioojimlkcljjjepehacmgodjfdk`](https://socket.dev/chrome/package/ghlcmioojimlkcljjjepehacmgodjfdk) (WHATSATLANTIC) — 87 users
    
95. [`poemcanhdcddpkjmdgegfiopikiheppd`](https://socket.dev/chrome/package/poemcanhdcddpkjmdgegfiopikiheppd) (Alô IA) — 6 users
    
96. [`pmpcobjbffgoalkbilglngiomdbpmffd`](https://socket.dev/chrome/package/pmpcobjbffgoalkbilglngiomdbpmffd) (ZapyPrime) — 16 users
    
97. [`lpbhcehpljligfjkcjpfklackjfoomao`](https://socket.dev/chrome/package/lpbhcehpljligfjkcjpfklackjfoomao) (WhizzChat) — 28 users
    
98. [`lmoncmhkblbcbekgefgpkohplhjkfgbm`](https://socket.dev/chrome/package/lmoncmhkblbcbekgefgpkohplhjkfgbm) (RoboZapp) — 68 users
    
99. [`cbgbkbafakhpmmdmbaafniijhifoikei`](https://socket.dev/chrome/package/cbgbkbafakhpmmdmbaafniijhifoikei) (ARX Tecnologia) — 2 users
    
100. [`odlgfgmgiinbkobmfhgmphbpfpmofppf`](https://socket.dev/chrome/package/odlgfgmgiinbkobmfhgmphbpfpmofppf) (Tryno CRM) — 23 users
    
101. [`aekhfllepcmekghgdhgbceojklhhioba`](https://socket.dev/chrome/package/aekhfllepcmekghgdhgbceojklhhioba) (Zaptree) — 8 users
    
102. [`ilahhiccjmanljjhebdpoilbfhjgpckp`](https://socket.dev/chrome/package/ilahhiccjmanljjhebdpoilbfhjgpckp) (360° Management CRM) — 22 users
    
103. [`agmdligmnfaciogcnokodiaoppflebla`](https://socket.dev/chrome/package/agmdligmnfaciogcnokodiaoppflebla) (Biz Sale Chat & CRM) — users not shown
    
104. [`ahejniinncebcikkjhggpghpjlkgjoab`](https://socket.dev/chrome/package/ahejniinncebcikkjhggpghpjlkgjoab) (Wavenda) — 44 users
    
105. [`kajbnhbibimhcmkpeokmgdpnhddjncka`](https://socket.dev/chrome/package/kajbnhbibimhcmkpeokmgdpnhddjncka) (GMD-ON) — 20 users
    
106. [`kahaenfigldjkcjpnblmhbbkkgfjkhhl`](https://socket.dev/chrome/package/kahaenfigldjkcjpnblmhbbkkgfjkhhl) (ZapCORR Suite) — 12 users
    
107. [`gfkedhmelaeoklidjhdbgpbnjdcacced`](https://socket.dev/chrome/package/gfkedhmelaeoklidjhdbgpbnjdcacced) (Zap Gestor CRM) — 12 users
    
108. [`gfplcnpcmgddenkggdapkcokgnkgncfe`](https://socket.dev/chrome/package/gfplcnpcmgddenkggdapkcokgnkgncfe) (Myboot) — users not shown
    
109. [`mdchifijocjccoidjcaamcebbehehlgo`](https://socket.dev/chrome/package/mdchifijocjccoidjcaamcebbehehlgo) (Sales Whats Brasil) — 7 users
    
110. [`ebjpepgmlmbfgjdefdhobjfnhpgepibd`](https://socket.dev/chrome/package/ebjpepgmlmbfgjdefdhobjfnhpgepibd) (IMPAR CRM) — 4 users
    
111. [`fkkjcbogndlaeofafjjdlckkodpnlafb`](https://socket.dev/chrome/package/fkkjcbogndlaeofafjjdlckkodpnlafb) (Oh Mago CRM para Whatsapp) — users not shown
    
112. [`cdjijomcoohechfbkipcibpcakldfceo`](https://socket.dev/chrome/package/cdjijomcoohechfbkipcibpcakldfceo) (DataZap: Automação, CRM) — 30 users
    
113. [`egebdiofdkgfhheopdaecggogdeaaepj`](https://socket.dev/chrome/package/egebdiofdkgfhheopdaecggogdeaaepj) (TekZap Conversas) — 46 users
    
114. [`nhmcfloglkbnliknncnfnlhideepfpfi`](https://socket.dev/chrome/package/nhmcfloglkbnliknncnfnlhideepfpfi) (Lobo Vendedor) — users not shown
    
115. [`fdofhoefhcjllmgcgpdplndaeebfnica`](https://socket.dev/chrome/package/fdofhoefhcjllmgcgpdplndaeebfnica) (Gana Digital) — users not shown
    
116. [`iflolbkfpmpjobjhkamajiekpmepcban`](https://socket.dev/chrome/package/iflolbkfpmpjobjhkamajiekpmepcban) (WHATZIP) — 19 users
    
117. [`dcgdocmggapfdocodbimagkloacnkbjf`](https://socket.dev/chrome/package/dcgdocmggapfdocodbimagkloacnkbjf) (STUDIO ZAP) — 37 users
    
118. [`llijmcnalgidmchdckmpimhhffehfbbg`](https://socket.dev/chrome/package/llijmcnalgidmchdckmpimhhffehfbbg) (Novo Envio Extensão: CRM) — 110 users
    
119. [`eaeiigegpmgegjhcbohmhddjgaldbknn`](https://socket.dev/chrome/package/eaeiigegpmgegjhcbohmhddjgaldbknn) (FortChat) — users not shown
    
120. [`fibommgfjfckaingpopkdohoegidkmng`](https://socket.dev/chrome/package/fibommgfjfckaingpopkdohoegidkmng) (Cash Zapp) — 17 users
    
121. [`fgfbklebnaaimlcgmfohnlnkihahlagk`](https://socket.dev/chrome/package/fgfbklebnaaimlcgmfohnlnkihahlagk) (ChatBlink) — 786 users
    
122. [`cjiedabijhhefgeonkdodnpaiimfdlpd`](https://socket.dev/chrome/package/cjiedabijhhefgeonkdodnpaiimfdlpd) (Projeta Zap) — 49 users
    
123. [`lhngnpihljickmbkflaiobcblmhchpab`](https://socket.dev/chrome/package/lhngnpihljickmbkflaiobcblmhchpab) (Conectadus CRM) — 13 users
    
124. [`jpioocoiojejijkbnpljcoonohmechha`](https://socket.dev/chrome/package/jpioocoiojejijkbnpljcoonohmechha) (Zap4Biz) — users not shown
    
125. [`haieolmfmmepgdimacfanclfemodnmep`](https://socket.dev/chrome/package/haieolmfmmepgdimacfanclfemodnmep) (BYS Convert) — users not shown
    
126. [`fjfpgmaghnjnjndiapfmehebankomkmc`](https://socket.dev/chrome/package/fjfpgmaghnjnjndiapfmehebankomkmc) (Fluxo de Vendas) — 10 users
    
127. [`clkibjppajhlbhofckbilehgfjjmljnj`](https://socket.dev/chrome/package/clkibjppajhlbhofckbilehgfjjmljnj) (Evento Prime) — users not shown
    
128. [`jbkmdabbenlckohhpccihkingphnoaom`](https://socket.dev/chrome/package/jbkmdabbenlckohhpccihkingphnoaom) (WizeChat) — users not shown
    
129. [`lepbljmnjohannb`](https://socket.dev/chrome/package/oikahlogkilifeoehlepbljmnjohannb) (MyZapCRM) — 1 user
    
130. [`aogcmjgadbnlpjjcppfcjndmnffbeiid`](https://socket.dev/chrome/package/aogcmjgadbnlpjjcppfcjndmnffbeiid) (Vozco Scale) — 10 users
    
131. [`dknafkoneldddpgcomhckilhhfodcnkk`](https://socket.dev/chrome/package/dknafkoneldddpgcomhckilhhfodcnkk) (Atendi Light) — users not shown
    

### **How "Spamware" Works**

After installation, the extension **injects malicious JavaScript directly into web.whatsapp.com**:

1. **Attaches to the page's DOM**: Runs alongside WhatsApp scripts, calling internal APIs to send automated messages.
    
2. **Loads remote configuration**: Service worker fetches config files from the attacker's server, updating message patterns and throttling to avoid anti-spam measures.
    
3. **Automates without confirmation**: Sends mass spam, scrapes contacts, schedules – bypassing WhatsApp's rate limit.[**rewterz.com**](https://rewterz.com/threat-advisory/131-malicious-whatsapp-extensions-discovered-on-chrome-web-store-active-iocs)
    

**Kirill Boychenko**, a researcher at Socket, warns: *"They aren't classic malware, but they act as high-risk spam automation, violating platform rules. The goal is to keep the spam campaign running continuously without detection."*

The activity lasted from **early 2025 to 10/17/2025**, with continuous updates.

### **Serious Impact**

* **Individual/Business Users**: WhatsApp accounts are spammed and permanently banned; contact data is misused.
    
* **Platform**: WhatsApp is overloaded with spam, mainly in Brazil, where WhatsApp is the "king of messaging."
    
* **Larger Connection**: Linked with the SORVEPOTEL worm (Trend Micro, Sophos, Kaspersky), distributing the banking trojan Maverick.
    

Forbes emphasizes: *"Immediately remove any extensions on the list if you use WhatsApp!"*

**Response from Google and Others**: No official statement yet, but extensions violate the **Spam & Abuse Policy** (developer.chrome.com/docs/webstore/program-policies). Some sources say Google has **partially removed** them following the report.

## **Recommendations**

FPT Threat Intelligence suggests several measures for checking and protection when facing attacks on:

1. **Check and remove extensions**:
    
    | **Step** | **Action** |
    | --- | --- |
    | 1 | Open Chrome > chrome://extensions/ |
    | 2 | Search as: YouSeller, ZapVende... |
    | 3 | **Toggle OFF** > **Remove** [**forbes.com**](https://www.forbes.com/sites/zakdoffman/2025/10/21/if-you-use-whatsapp-delete-every-chrome-extension-on-this-list/) |
    
2. **Scan for malware**: Use antivirus software like Malwarebytes, ESET, or Windows Defender (full scan).
    
3. **Change WhatsApp password**: Check for unfamiliar accounts.
    
4. **Clear cache**: chrome://settings/clearBrowserData.
    

## References

[https://rewterz.com/threat-advisory/131-malicious-whatsapp-extensions-discovered-on-chrome-web-store-active-iocs](https://rewterz.com/threat-advisory/131-malicious-whatsapp-extensions-discovered-on-chrome-web-store-active-iocs)

[https://socket.dev/blog/131-spamware-extensions-targeting-whatsapp-flood-chrome-web-store](https://socket.dev/blog/131-spamware-extensions-targeting-whatsapp-flood-chrome-web-store)

[https://thehackernews.com/2025/10/131-chrome-extensions-caught-hijacking.html](https://thehackernews.com/2025/10/131-chrome-extensions-caught-hijacking.html)