# 131 Tiện Ích Mở Rộng Chrome Bị Phát Hiện Chiếm Quyền Điều Khiển Trình Duyệt

Trong một phát hiện chấn động mới nhất, các nhà nghiên cứu an ninh mạng từ công ty Socket đã vạch trần chiến dịch spam quy mô lớn sử dụng **131 extension Chrome giả mạo**, được thiết kế để "khủng bố" WhatsApp Web bằng cách tự động hóa gửi tin nhắn hàng loạt mà không cần sự đồng ý của người dùng. Những extension này đã lây lan trên Chrome Web Store trong ít nhất 9 tháng qua, ảnh hưởng đến khoảng **20.905 người dùng hoạt động**.

Dù không phải là phần mềm độc hại cổ điển (malware), chúng được phân loại là **"spamware" cao nguy cơ**, vi phạm nghiêm trọng chính sách của Google Chrome Web Store về nội dung trùng lặp và gửi tin nhắn không được phép. Chiến dịch này không chỉ làm ngập WhatsApp bằng spam mà còn có nguy cơ dẫn đến tài khoản bị khóa, đánh cắp dữ liệu liên hệ và lan truyền lừa đảo.

## **Tổng quan**

Các extension này là các bản **clone được rebrand** từ một công cụ tự động hóa WhatsApp Web duy nhất, chia sẻ **codebase, thiết kế và hạ tầng giống hệt nhau**. Chúng được phát hành chủ yếu bởi hai tài khoản developer: **"WL Extensão"** (83 extension) và biến thể **"WLExtensao"**, liên kết với công ty **DBX Tecnologia** tại Brazil – một chương trình white-label cho phép affiliate rebrand và bán lại.

Chúng ngụy trang dưới dạng **công cụ CRM cho WhatsApp**, hứa hẹn:

* Tự động hóa tin nhắn hàng loạt (bulk messaging)
    
* Lên lịch gửi tin
    
* Quản lý lead, phễu bán hàng trực quan
    
* Tổ chức dịch vụ khách hàng
    

| **Tên Extension Nổi Bật** | **Số Người Dùng** | **Developer** | **Chức Năng Giả Mạo** |
| --- | --- | --- | --- |
| YouSeller | 10.000 | WL Extensão | CRM bán hàng WhatsApp |
| performancemais | 239 | WL Extensão | Tối ưu hóa hiệu suất |
| Botflow | 38 | WL Extensão | Tự động hóa bot |
| ZapVende | 32 | WLExtensao | Phễu bán hàng |

**Danh sách đầy đủ 131 extension** từ báo cáo của Socket (socket.dev/blog).

1. [`gioekliddhmaanejaaigfokghoakbaco`](https://socket.dev/chrome/package/gioekliddhmaanejaaigfokghoakbaco) (WaveZap CRM) — 112 users
    
2. [`ephcniiibhpjpfpopmajlmbbijfjpdde`](https://socket.dev/chrome/package/ephcniiibhpjpfpopmajlmbbijfjpdde) (WaCelery) — users not shown
    
3. [`fbkpechbcdilkoadejmhhamidddhdehc`](https://socket.dev/chrome/package/fbkpechbcdilkoadejmhhamidddhdehc) (Top System) — 18 users
    
4. [`ehdekncpobdjejklgpgnjgddjdnblmei`](https://socket.dev/chrome/package/ehdekncpobdjejklgpgnjgddjdnblmei) (Botflow) — 35 users
    
5. [`mnbdaobmkdglnmiagimcniebbgebabek`](https://socket.dev/chrome/package/mnbdaobmkdglnmiagimcniebbgebabek) (Organize-C) — 5,000 users
    
6. [`jelgokpkjcplgcckfiaddlfaaepohfdi`](https://socket.dev/chrome/package/jelgokpkjcplgcckfiaddlfaaepohfdi) (FQ Sales CRM) — 30 users
    
7. [`pmnkmmlmbnalnbgidejbcaigahodcppn`](https://socket.dev/chrome/package/pmnkmmlmbnalnbgidejbcaigahodcppn) (Nexus CRM) — 23 users
    
8. [`ipaoladdllekkdokdnemkpjfllbgplek`](https://socket.dev/chrome/package/ipaoladdllekkdokdnemkpjfllbgplek) (FLEXZAP) — 71 users
    
9. [`gmdnikelbimgeamkdhpdblmeekpojeei`](https://socket.dev/chrome/package/gmdnikelbimgeamkdhpdblmeekpojeei) (BoostChat) — 6 users
    
10. [`lbnhlbjmibbmogaefkppniejgaadimdb`](https://socket.dev/chrome/package/lbnhlbjmibbmogaefkppniejgaadimdb) (WaZap) — 104 users
    
11. [`gmmcjjpciafncfbggmjhglocogcaomjb`](https://socket.dev/chrome/package/gmmcjjpciafncfbggmjhglocogcaomjb) (Convverso CRM) — 44 users
    
12. [`hjlpccojkgfkamonoaoakgjjlejonefo`](https://socket.dev/chrome/package/hjlpccojkgfkamonoaoakgjjlejonefo) (JuriMind CRM) — 24 users
    
13. [`chkaiafjmlfakkibkhbfgfklfaachmnc`](https://socket.dev/chrome/package/chkaiafjmlfakkibkhbfgfklfaachmnc) (ZapKan) — 31 users
    
14. [`oohihogmmfbinbkgaiglgeabloiehlkk`](https://socket.dev/chrome/package/oohihogmmfbinbkgaiglgeabloiehlkk) (Zap Vende) — 30 users
    
15. [`jgfaobieaananaaahonfomlibhchkndb`](https://socket.dev/chrome/package/jgfaobieaananaaahonfomlibhchkndb) (AngoSeller) — 13 users
    
16. [`jhfdppbgfmmaecdgmboadmkaoifjnfmm`](https://socket.dev/chrome/package/jhfdppbgfmmaecdgmboadmkaoifjnfmm) (Vou Falar) — 4 users
    
17. [`phamkmfigepogfnbkelfmknehfcjjklm`](https://socket.dev/chrome/package/phamkmfigepogfnbkelfmknehfcjjklm) (Chatty Seller) — 23 users
    
18. [`jheebhheaomejiiilhgkambdgagmhfhe`](https://socket.dev/chrome/package/jheebhheaomejiiilhgkambdgagmhfhe) (GFlow Chat) — 33 users
    
19. [`foedfcdeffihcmjibkbaffddbjdmkphi`](https://socket.dev/chrome/package/foedfcdeffihcmjibkbaffddbjdmkphi) (CNW ZAP) — 25 users
    
20. [`jhiknfikchccfkhjbfgiolgjofbnmgkd`](https://socket.dev/chrome/package/jhiknfikchccfkhjbfgiolgjofbnmgkd) (66seller) — users not shown
    
21. [`cbhhipokgmechdbhebbalpckddlnfggm`](https://socket.dev/chrome/package/cbhhipokgmechdbhebbalpckddlnfggm) (Doris CRM) — 19 users
    
22. [`cjdcglineikacjboikmchenneanfegoo`](https://socket.dev/chrome/package/cjdcglineikacjboikmchenneanfegoo) (ZappSeller) — 296 users
    
23. [`jmnajdcdmikociadheoaelpejbmoklpm`](https://socket.dev/chrome/package/jmnajdcdmikociadheoaelpejbmoklpm) (CliQ+) — users not shown
    
24. [`jpfpmealiajnfjmiljnmpiifccfkaimj`](https://socket.dev/chrome/package/jpfpmealiajnfjmiljnmpiifccfkaimj) (À Venda - CRM) — 118 users
    
25. [`mcabhobmhiljmdbdigdkkhmhjieecmne`](https://socket.dev/chrome/package/mcabhobmhiljmdbdigdkkhmhjieecmne) (MkZap) — 19 users
    
26. [`pedngakkndckkgfpbdmfmokokdepekho`](https://socket.dev/chrome/package/pedngakkndckkgfpbdmfmokokdepekho) (WhatSmart CRM) — 208 users
    
27. [`lefiaoknofkoecahieockfmhhklkigng`](https://socket.dev/chrome/package/lefiaoknofkoecahieockfmhhklkigng) (Sanzap) — 32 users
    
28. [`mcjdknfjmchailcpcolfjcogggkjfeij`](https://socket.dev/chrome/package/mcjdknfjmchailcpcolfjcogggkjfeij) (WaGpro) — 112 users
    
29. [`mecaooaegbmnneijdhegohdpcepdbbmk`](https://socket.dev/chrome/package/mecaooaegbmnneijdhegohdpcepdbbmk) (Lexchatbot) — users not shown
    
30. [`mppgfleddoodfifpkjjjdbngnkcfcnde`](https://socket.dev/chrome/package/mppgfleddoodfifpkjjjdbngnkcfcnde) (performancemais) — 241 users
    
31. [`igmalhleeaoclfmfdlepdmfnbipkfdfi`](https://socket.dev/chrome/package/igmalhleeaoclfmfdlepdmfnbipkfdfi) (Merlix) — 3 users
    
32. [`eomlbgjohomgjjigponmbnedpgoegegl`](https://socket.dev/chrome/package/eomlbgjohomgjjigponmbnedpgoegegl) (ChatScript) — 6 users
    
33. [`mgpdpmifcljbddedpajabokdebnaemon`](https://socket.dev/chrome/package/mgpdpmifcljbddedpajabokdebnaemon) (BC ZAP) — 44 users
    
34. [`ofmhnbjohiadaagpeibjlncncllelaoo`](https://socket.dev/chrome/package/ofmhnbjohiadaagpeibjlncncllelaoo) (Speedsflow CRM) — 5 users
    
35. [`ofmoeicegmlaleajnpcbddiaomnfmfkp`](https://socket.dev/chrome/package/ofmoeicegmlaleajnpcbddiaomnfmfkp) (DBX Whats) — 1,000 users
    
36. [`hnimkbcgbhlllkcnphhhnbilkjngpphh`](https://socket.dev/chrome/package/hnimkbcgbhlllkcnphhhnbilkjngpphh) (HGTX Intelligence Starter) — users not shown
    
37. [`chdaaapnpinagdkdmkkoandalpdgikdh`](https://socket.dev/chrome/package/chdaaapnpinagdkdmkkoandalpdgikdh) (Wabin) — 17 users
    
38. [`cijeamgoejpplpdnjhejeeahgkbdndni`](https://socket.dev/chrome/package/cijeamgoejpplpdnjhejeeahgkbdndni) (Zaplyd - CRM) — 449 users
    
39. [`pilfkgcokfmoblofkghajplgdpmejjph`](https://socket.dev/chrome/package/pilfkgcokfmoblofkghajplgdpmejjph) (FleboLeads) — 24 users
    
40. [`pfhinnfbeephmihjjegokhbkaeckdldp`](https://socket.dev/chrome/package/pfhinnfbeephmihjjegokhbkaeckdldp) (Monchat) — 5 users
    
41. [`hpopdnbfeddglbokfbainoglnhhoccpb`](https://socket.dev/chrome/package/hpopdnbfeddglbokfbainoglnhhoccpb) (Zappower) — 29 users
    
42. [`gclllmamoegojkehkkohcfcjdmgikldc`](https://socket.dev/chrome/package/gclllmamoegojkehkkohcfcjdmgikldc) (Converzap) — 7 users
    
43. [`hnnbkomgboilfohfkpfgnlcpalcnangb`](https://socket.dev/chrome/package/hnnbkomgboilfohfkpfgnlcpalcnangb) (Bot Imobiliário) — 50 users
    
44. [`hocidiaogjnnibkadkedncomnglnehjg`](https://socket.dev/chrome/package/hocidiaogjnnibkadkedncomnglnehjg) (Lucra Zap) — users not shown
    
45. [`niimbdmbkndibiabpoolngcjipgndijh`](https://www.notion.so/131-Spamware-Extensions-Targeting-WhatsApp-Flood-Chrome-Web-Store-28c4cb3adfeb80759c4fdfe2cb05e24c?pvs=21) (Donna CRM) — users not shown
    
46. [`okdhkkpmmhinmjipggbfpjbdlckkaemb`](https://socket.dev/chrome/package/okdhkkpmmhinmjipggbfpjbdlckkaemb) (Zaplyn) — users not shown
    
47. [`mjailbbfmgaoojmjfcacffkdjoccggcf`](https://socket.dev/chrome/package/mjailbbfmgaoojmjfcacffkdjoccggcf) (FácilCRM) — 174 users
    
48. [`aippcgffdfgfkihejnjkmkbjoidpemcl`](https://socket.dev/chrome/package/aippcgffdfgfkihejnjkmkbjoidpemcl) (IV-CHAT) — users not shown
    
49. [`bajadmkhmpjaiibgakhdgpgllgnhdocc`](https://socket.dev/chrome/package/bajadmkhmpjaiibgakhdgpgllgnhdocc) (Talk Zap CRM) — 33 users
    
50. [`bmcliihacfhpicjacebpnhliojphelck`](https://socket.dev/chrome/package/bmcliihacfhpicjacebpnhliojphelck) (Sellerwork) — 15 users
    
51. [`mjhdkfgdfcehianhcmjpgpicelgehbbe`](https://socket.dev/chrome/package/mjhdkfgdfcehianhcmjpgpicelgehbbe) (Wazapy) — 4 users
    
52. [`mhcnngbhhpmlahekicpkpammjibamlip`](https://socket.dev/chrome/package/mhcnngbhhpmlahekicpkpammjibamlip) (SALES WHATS) — 213 users
    
53. [`jfcekpbabbijmfpcgnnoaekodnagbffd`](https://socket.dev/chrome/package/jfcekpbabbijmfpcgnnoaekodnagbffd) (Super Chat Boom) — users not shown
    
54. [`ahpcdagejgoffjpnbkhemojogbocbahe`](https://socket.dev/chrome/package/ahpcdagejgoffjpnbkhemojogbocbahe) (ChatAds) — 122 users
    
55. [`mkbjflhgpickfellipdmpcnhkmmdcojl`](https://socket.dev/chrome/package/mkbjflhgpickfellipdmpcnhkmmdcojl) (YouSeller) — 10,000 users
    
56. [`nmnflpdnbpnoojmpmhkkiagmegimlnmm`](https://socket.dev/chrome/package/nmnflpdnbpnoojmpmhkkiagmegimlnmm) (FLOW 5.0) — users not shown
    
57. [`nnmbiaaomdknpkgpklfcekneilkimoal`](https://socket.dev/chrome/package/nnmbiaaomdknpkgpklfcekneilkimoal) (TELEFON CONECTA) — 13 users
    
58. [`bjbdjeijmkjcphbmbiifoeaikbmmgcjp`](https://socket.dev/chrome/package/bjbdjeijmkjcphbmbiifoeaikbmmgcjp) (WA FLASH) — 104 users
    
59. [`kekglidebofmckpkojgbogajflnmhega`](https://socket.dev/chrome/package/kekglidebofmckpkojgbogajflnmhega) (MovvaSe) — users not shown
    
60. [`kfopgoafhfkcpnkiemaldlplpbnengjf`](https://socket.dev/chrome/package/kfopgoafhfkcpnkiemaldlplpbnengjf) (Power Chat) — 25 users
    
61. [`nmimioepofbhnidpmebigbahpckjfmbm`](https://socket.dev/chrome/package/nmimioepofbhnidpmebigbahpckjfmbm) (Chatfunel) — 54 users
    
62. [`clpedhieolcgejlfdnlfadojpaiahlfm`](https://socket.dev/chrome/package/clpedhieolcgejlfdnlfadojpaiahlfm) (VicChat) — users not shown
    
63. [`pmdahofhcbcejdodnmijkhahahegenhi`](https://socket.dev/chrome/package/pmdahofhcbcejdodnmijkhahahegenhi) (INWISE CRM) — 13 users
    
64. [`hhlbnnfmjdoeegpoihgandmppnmfpeib`](https://socket.dev/chrome/package/hhlbnnfmjdoeegpoihgandmppnmfpeib) (ZapForce) — 8 users
    
65. [`jleilnojaafdekbbpighcjlcbmfnifim`](https://socket.dev/chrome/package/jleilnojaafdekbbpighcjlcbmfnifim) (ZapWild - CRM) — users not shown
    
66. [`maopdiomoidladgapokmfggnccpolbol`](https://socket.dev/chrome/package/maopdiomoidladgapokmfggnccpolbol) (WhatsTool) — 27 users
    
67. [`cgcckeanlanlpaflhipplbhichjejgpk`](https://socket.dev/chrome/package/cgcckeanlanlpaflhipplbhichjejgpk) (Lever CRM) — 81 users
    
68. [`kleicpolamoebhoajpbhcbmcihbcfobm`](https://socket.dev/chrome/package/kleicpolamoebhoajpbhcbmcihbcfobm) (Opendoor Solucoes) — users not shown
    
69. [`kmhlbkgpafhoojblcfhnljaaighbejfk`](https://socket.dev/chrome/package/kmhlbkgpafhoojblcfhnljaaighbejfk) (Yconecta Latam) — 9 users
    
70. [`ifhkkkfghpgbelajdcmkbahibfieffkl`](https://socket.dev/chrome/package/ifhkkkfghpgbelajdcmkbahibfieffkl) (Pipe Loom) — users not shown
    
71. [`blpopmcoebhlkolmkjjmplbmlgdhggkk`](https://socket.dev/chrome/package/blpopmcoebhlkolmkjjmplbmlgdhggkk) (Connect Castle Solution) — users not shown
    
72. [`begphlgbbimlphmfbigfjcadjgplglcg`](https://socket.dev/chrome/package/begphlgbbimlphmfbigfjcadjgplglcg) (ATENDO DO ZAP) — 34 users
    
73. [`bmeleciepnphilegegcbfjkoolldigid`](https://socket.dev/chrome/package/bmeleciepnphilegegcbfjkoolldigid) ([**SYS.AO**](http://sys.ao/)) — 23 users
    
74. [`ebmbbmldkfhfambpnegomegconmhcioe`](https://www.notion.so/Eng-Standup-Threat-Analysis-28d4cb3adfeb8097a7b4fd68d02f8196?pvs=21) (Evoluwa) — users not shown
    
75. [`ddmhkpkipjnhlppmcepckfgjbmljmphm`](https://socket.dev/chrome/package/ddmhkpkipjnhlppmcepckfgjbmljmphm) (Maiq) — 7 users
    
76. [`jjopcmgbpnfdehgmbioibahegdmmfipm`](https://socket.dev/chrome/package/jjopcmgbpnfdehgmbioibahegdmmfipm) (Zap4u) — users not shown
    
77. [`hdonddbodcfamjgmdolkgfgidjfmijmj`](https://socket.dev/chrome/package/hdonddbodcfamjgmdolkgfgidjfmijmj) (Evan’s Atende) — 33 users
    
78. [`anoghcdepimhncglcecmgnbchpjfkonp`](https://socket.dev/chrome/package/anoghcdepimhncglcecmgnbchpjfkonp) (MestreZap) — users not shown
    
79. [`oiekdjliebhjpjknfojajhjebgeedhag`](https://socket.dev/chrome/package/oiekdjliebhjpjknfojajhjebgeedhag) (Salesly) — 7 users
    
80. [`ohekppieeepibkebnlilabljmnkffmof`](https://socket.dev/chrome/package/ohekppieeepibkebnlilabljmnkffmof) (ZapLead) — 25 users
    
81. [`ohojiglgbgnhaddfhdbkoclekhghncih`](https://socket.dev/chrome/package/ohojiglgbgnhaddfhdbkoclekhghncih) (Chat Power) — users not shown
    
82. [`ekigeoglcndojhecmojcchlhjkbghnmg`](https://socket.dev/chrome/package/ekigeoglcndojhecmojcchlhjkbghnmg) (FarChat) — 28 users
    
83. [`mlladklbipjfnjgjjbkofonboojklnpo`](https://socket.dev/chrome/package/mlladklbipjfnjgjjbkofonboojklnpo) (idk Converte) — 6 users
    
84. [`edgokehfaihammibdolojeljlccobihi`](https://socket.dev/chrome/package/edgokehfaihammibdolojeljlccobihi) (VEXA INOVAÇÃO) — 2 users
    
85. [`eecbjpnghjlfeanpabnebopncfldgkej`](https://socket.dev/chrome/package/eecbjpnghjlfeanpabnebopncfldgkej) (Polo Lucrativo) — 6 users
    
86. [`namibohbbclnmgbnhegongpbkphhelji`](https://socket.dev/chrome/package/namibohbbclnmgbnhegongpbkphhelji) (Sell Swift) — 5 users
    
87. [`ndilbmjmeggijafdloohkniglleeekff`](https://socket.dev/chrome/package/ndilbmjmeggijafdloohkniglleeekff) (Red Chat) — 12 users
    
88. [`bpinnifebepjjedmficfllcnalhcfgin`](https://socket.dev/chrome/package/bpinnifebepjjedmficfllcnalhcfgin) (Hizi Chat) — users not shown
    
89. [`fkcbkncgbolfiijohpipeobfbopidhlg`](https://socket.dev/chrome/package/fkcbkncgbolfiijohpipeobfbopidhlg) (HBS CONNECT) — users not shown
    
90. [`bcabbcjlfhhffnjjfebenghlgfpfobdg`](https://socket.dev/chrome/package/bcabbcjlfhhffnjjfebenghlgfpfobdg) (EAI MAIS) — users not shown
    
91. [`nfoenldfhfooabacoilpappaoggfmdio`](https://socket.dev/chrome/package/nfoenldfhfooabacoilpappaoggfmdio) (ifteczap CRM) — users not shown
    
92. [`bmfeoaglddjefdcdmnaohgjlanmmddog`](https://socket.dev/chrome/package/bmfeoaglddjefdcdmnaohgjlanmmddog) (ByteZap) — 21 users
    
93. [`mpcajkogkmebocmcflglhmdekfglallb`](https://socket.dev/chrome/package/mpcajkogkmebocmcflglhmdekfglallb) (Cresça & Apareça CRM) — 4 users
    
94. [`ghlcmioojimlkcljjjepehacmgodjfdk`](https://socket.dev/chrome/package/ghlcmioojimlkcljjjepehacmgodjfdk) (WHATSATLANTIC) — 87 users
    
95. [`poemcanhdcddpkjmdgegfiopikiheppd`](https://socket.dev/chrome/package/poemcanhdcddpkjmdgegfiopikiheppd) (Alô IA) — 6 users
    
96. [`pmpcobjbffgoalkbilglngiomdbpmffd`](https://socket.dev/chrome/package/pmpcobjbffgoalkbilglngiomdbpmffd) (ZapyPrime) — 16 users
    
97. [`lpbhcehpljligfjkcjpfklackjfoomao`](https://socket.dev/chrome/package/lpbhcehpljligfjkcjpfklackjfoomao) (WhizzChat) — 28 users
    
98. [`lmoncmhkblbcbekgefgpkohplhjkfgbm`](https://socket.dev/chrome/package/lmoncmhkblbcbekgefgpkohplhjkfgbm) (RoboZapp) — 68 users
    
99. [`cbgbkbafakhpmmdmbaafniijhifoikei`](https://socket.dev/chrome/package/cbgbkbafakhpmmdmbaafniijhifoikei) (ARX Tecnologia) — 2 users
    
100. [`odlgfgmgiinbkobmfhgmphbpfpmofppf`](https://socket.dev/chrome/package/odlgfgmgiinbkobmfhgmphbpfpmofppf) (Tryno CRM) — 23 users
    
101. [`aekhfllepcmekghgdhgbceojklhhioba`](https://socket.dev/chrome/package/aekhfllepcmekghgdhgbceojklhhioba) (Zaptree) — 8 users
    
102. [`ilahhiccjmanljjhebdpoilbfhjgpckp`](https://socket.dev/chrome/package/ilahhiccjmanljjhebdpoilbfhjgpckp) (360° Management CRM) — 22 users
    
103. [`agmdligmnfaciogcnokodiaoppflebla`](https://socket.dev/chrome/package/agmdligmnfaciogcnokodiaoppflebla) (Biz Sale Chat & CRM) — users not shown
    
104. [`ahejniinncebcikkjhggpghpjlkgjoab`](https://socket.dev/chrome/package/ahejniinncebcikkjhggpghpjlkgjoab) (Wavenda) — 44 users
    
105. [`kajbnhbibimhcmkpeokmgdpnhddjncka`](https://socket.dev/chrome/package/kajbnhbibimhcmkpeokmgdpnhddjncka) (GMD-ON) — 20 users
    
106. [`kahaenfigldjkcjpnblmhbbkkgfjkhhl`](https://socket.dev/chrome/package/kahaenfigldjkcjpnblmhbbkkgfjkhhl) (ZapCORR Suite) — 12 users
    
107. [`gfkedhmelaeoklidjhdbgpbnjdcacced`](https://socket.dev/chrome/package/gfkedhmelaeoklidjhdbgpbnjdcacced) (Zap Gestor CRM) — 12 users
    
108. [`gfplcnpcmgddenkggdapkcokgnkgncfe`](https://socket.dev/chrome/package/gfplcnpcmgddenkggdapkcokgnkgncfe) (Myboot) — users not shown
    
109. [`mdchifijocjccoidjcaamcebbehehlgo`](https://socket.dev/chrome/package/mdchifijocjccoidjcaamcebbehehlgo) (Sales Whats Brasil) — 7 users
    
110. [`ebjpepgmlmbfgjdefdhobjfnhpgepibd`](https://socket.dev/chrome/package/ebjpepgmlmbfgjdefdhobjfnhpgepibd) (IMPAR CRM) — 4 users
    
111. [`fkkjcbogndlaeofafjjdlckkodpnlafb`](https://socket.dev/chrome/package/fkkjcbogndlaeofafjjdlckkodpnlafb) (Oh Mago CRM para Whatsapp) — users not shown
    
112. [`cdjijomcoohechfbkipcibpcakldfceo`](https://socket.dev/chrome/package/cdjijomcoohechfbkipcibpcakldfceo) (DataZap: Automação, CRM) — 30 users
    
113. [`egebdiofdkgfhheopdaecggogdeaaepj`](https://socket.dev/chrome/package/egebdiofdkgfhheopdaecggogdeaaepj) (TekZap Conversas) — 46 users
    
114. [`nhmcfloglkbnliknncnfnlhideepfpfi`](https://socket.dev/chrome/package/nhmcfloglkbnliknncnfnlhideepfpfi) (Lobo Vendedor) — users not shown
    
115. [`fdofhoefhcjllmgcgpdplndaeebfnica`](https://socket.dev/chrome/package/fdofhoefhcjllmgcgpdplndaeebfnica) (Gana Digital) — users not shown
    
116. [`iflolbkfpmpjobjhkamajiekpmepcban`](https://socket.dev/chrome/package/iflolbkfpmpjobjhkamajiekpmepcban) (WHATZIP) — 19 users
    
117. [`dcgdocmggapfdocodbimagkloacnkbjf`](https://socket.dev/chrome/package/dcgdocmggapfdocodbimagkloacnkbjf) (STUDIO ZAP) — 37 users
    
118. [`llijmcnalgidmchdckmpimhhffehfbbg`](https://socket.dev/chrome/package/llijmcnalgidmchdckmpimhhffehfbbg) (Novo Envio Extensão: CRM) — 110 users
    
119. [`eaeiigegpmgegjhcbohmhddjgaldbknn`](https://socket.dev/chrome/package/eaeiigegpmgegjhcbohmhddjgaldbknn) (FortChat) — users not shown
    
120. [`fibommgfjfckaingpopkdohoegidkmng`](https://socket.dev/chrome/package/fibommgfjfckaingpopkdohoegidkmng) (Cash Zapp) — 17 users
    
121. [`fgfbklebnaaimlcgmfohnlnkihahlagk`](https://socket.dev/chrome/package/fgfbklebnaaimlcgmfohnlnkihahlagk) (ChatBlink) — 786 users
    
122. [`cjiedabijhhefgeonkdodnpaiimfdlpd`](https://socket.dev/chrome/package/cjiedabijhhefgeonkdodnpaiimfdlpd) (Projeta Zap) — 49 users
    
123. [`lhngnpihljickmbkflaiobcblmhchpab`](https://socket.dev/chrome/package/lhngnpihljickmbkflaiobcblmhchpab) (Conectadus CRM) — 13 users
    
124. [`jpioocoiojejijkbnpljcoonohmechha`](https://socket.dev/chrome/package/jpioocoiojejijkbnpljcoonohmechha) (Zap4Biz) — users not shown
    
125. [`haieolmfmmepgdimacfanclfemodnmep`](https://socket.dev/chrome/package/haieolmfmmepgdimacfanclfemodnmep) (BYS Convert) — users not shown
    
126. [`fjfpgmaghnjnjndiapfmehebankomkmc`](https://socket.dev/chrome/package/fjfpgmaghnjnjndiapfmehebankomkmc) (Fluxo de Vendas) — 10 users
    
127. [`clkibjppajhlbhofckbilehgfjjmljnj`](https://socket.dev/chrome/package/clkibjppajhlbhofckbilehgfjjmljnj) (Evento Prime) — users not shown
    
128. [`jbkmdabbenlckohhpccihkingphnoaom`](https://socket.dev/chrome/package/jbkmdabbenlckohhpccihkingphnoaom) (WizeChat) — users not shown
    
129. [`lepbljmnjohannb`](https://socket.dev/chrome/package/oikahlogkilifeoehlepbljmnjohannb) (MyZapCRM) — 1 user
    
130. [`aogcmjgadbnlpjjcppfcjndmnffbeiid`](https://socket.dev/chrome/package/aogcmjgadbnlpjjcppfcjndmnffbeiid) (Vozco Scale) — 10 users
    
131. [`dknafkoneldddpgcomhckilhhfodcnkk`](https://socket.dev/chrome/package/dknafkoneldddpgcomhckilhhfodcnkk) (Atendi Light) — users not shown
    

### **Cách Thức Hoạt Động Của "Spamware"**

Sau khi cài đặt, extension **tiêm JavaScript độc hại trực tiếp vào web.whatsapp.com**:

1. **Gắn vào DOM của trang**: Chạy song song với script WhatsApp, gọi API nội bộ để gửi tin nhắn tự động.
    
2. **Tải cấu hình từ xa**: Service worker fetch file config từ server attacker, cập nhật pattern tin nhắn, throttling để né anti-spam.
    
3. **Tự động hóa không xác nhận**: Gửi hàng loạt tin spam, scrape contact, lập lịch – bypass giới hạn rate limit của WhatsApp.[**rewterz.com**](https://rewterz.com/threat-advisory/131-malicious-whatsapp-extensions-discovered-on-chrome-web-store-active-iocs)
    

**Kirill Boychenko**, nhà nghiên cứu Socket, cảnh báo: *"Chúng không phải malware cổ điển, nhưng hoạt động như spam automation cao rủi ro, vi phạm quy tắc nền tảng. Mục tiêu là giữ chiến dịch spam chạy liên tục mà không bị phát hiện."*

Hoạt động kéo dài từ **đầu 2025 đến 17/10/2025**, với cập nhật mới liên tục.

### **Tác Động Nghiêm Trọng**

* **Người dùng cá nhân/doanh nghiệp**: Tài khoản WhatsApp bị spam, khóa vĩnh viễn; dữ liệu liên hệ bị lạm dụng.
    
* **Nền tảng**: WhatsApp bị quá tải spam, chủ yếu Brazil – nơi WhatsApp là "vua nhắn tin".
    
* **Liên kết lớn hơn**: Kết hợp với worm SORVEPOTEL (Trend Micro, Sophos, Kaspersky), phân phối banking trojan Maverick.
    

Forbes nhấn mạnh: *"Xóa ngay mọi extension trong danh sách nếu bạn dùng WhatsApp!"*

**Phản Ứng Từ Google Và Các Bên**: Chưa có tuyên bố chính thức, nhưng các extension vi phạm **Chính sách Spam & Abuse** (developer.chrome.com/docs/webstore/program-policies). Một số nguồn cho biết Google đã **xóa một phần** sau báo cáo

## **Khuyến nghị**

Phía FPT Threat Intelligence đề xuất một số biện pháp kiểm tra và bảo vệ khi gặp tấn công trên

1. **Kiểm tra và xóa extension**: | 1 | Mở Chrome > chrome://extensions | 2 | Tìm tên như YouSeller, ZapVende... | 3 | Toggle OFF > Remove [forbes.com](http://forbes.com)
    
2. **Quét malware**: Sử dụng phần mềm AV như: Malwarebytes, ESET hoặc Windows Defender (full scan).
    
3. **Đổi mật khẩu WhatsApp**: Kiểm tra tài khoản lạ.
    
4. **Clear cache**: chrome://settings/clearBrowserData.
    

## Tham khảo

[https://rewterz.com/threat-advisory/131-malicious-whatsapp-extensions-discovered-on-chrome-web-store-active-iocs](https://rewterz.com/threat-advisory/131-malicious-whatsapp-extensions-discovered-on-chrome-web-store-active-iocs)

[https://socket.dev/blog/131-spamware-extensions-targeting-whatsapp-flood-chrome-web-store](https://socket.dev/blog/131-spamware-extensions-targeting-whatsapp-flood-chrome-web-store)

[https://thehackernews.com/2025/10/131-chrome-extensions-caught-hijacking.html](https://thehackernews.com/2025/10/131-chrome-extensions-caught-hijacking.html)