{“lastseen”:”2025-10-20T10:47:59″,”description”:”\\n\\nCybersecurity researchers have uncovered a coordinated campaign that leveraged 131 rebranded clones of a WhatsApp Web automation extension for Google Chrome to spam Brazilian users at scale.\\n\\nThe 131 spamware extensions share the same codebase, design patterns, and infrastructure, according to supply chain security company Socket. The browser add-ons collectively have about 20,905 active users.\\n\\n\\”They are not classic malware, but they function as high-risk spam automation that abuses platform rules,\\” security researcher Kirill Boychenko said. \\”The code injects directly into the WhatsApp Web page, running alongside WhatsApp’s own scripts, automates bulk outreach and scheduling in ways that aim to bypass WhatsApp’s anti-spam enforcement.\\”\\n\\nThe end goal of the campaign is to blast outbound messaging via WhatsApp in a manner that bypasses the messaging platform’s rate limits and anti-spam controls.\\n\\n\\n\\nThe activity is assessed to have been ongoing for at least nine months, with new uploads and version updates to the extensions observed as recently as October 17, 2025. Some of the identified extensions are listed below -\\n\\n * YouSeller (10,000 users)\\n * performancemais (239 users)\\n * Botflow (38 users)\\n * ZapVende (32 users)\\n\\n\\n\\nThe extensions have been found to embrace different names and logos, but, behind the scenes, the vast majority of them have been published by \\”WL Extens\u00e3o\\” and its variant \\”WLExtensao.\\” It’s believed that the differences in branding are the result of a franchise model that allows the operation’s affiliates to flood the Chrome Web Store with various clones of the original extension offered by a company named DBX Tecnologia.\\n\\nThese add-ons also claim to masquerade as customer relationship management (CRM) tools for WhatsApp, allowing users to maximize their sales through the web version of the application.\\n\\n\\”Turn your WhatsApp into a powerful sales and contact management tool. With Zap Vende, you’ll have an intuitive CRM, message automation, bulk messaging, visual sales funnel, and much more,\\” reads the description of ZapVende on the Chrome Web Store. \\”Organize your customer service, track leads, and schedule messages in a practical and efficient way.\\”\\n\\nDBX Tecnologia, per Socket, advertises a reseller white-label program to allow prospective partners to rebrand and sell its WhatsApp Web extension under their own brand, promising recurring revenue in the range of R$30,000 to R$84,000 by investing R$12,000.\\n\\n\\n\\nIt’s worth noting that the practice is in violation of Google’s Chrome Web Store Spam and Abuse policy, which bans developers and their affiliates from submitting multiple extensions that provide duplicate functionality on the platform. DBX Tecnologia has also been found to have put out YouTube videos about bypassing WhatsApp’s anti-spam algorithms when using the extensions.\\n\\n\\”The cluster consists of near-identical copies spread across publisher accounts, is marketed for bulk unsolicited outreach, and automates message sending inside web.whatsapp.com without user confirmation,\\” Boychenko noted. \\”The goal is to keep bulk campaigns running while evading anti-spam systems.\\”\\n\\nThe disclosure comes as Trend Micro, Sophos, and Kaspersky shed light on a large-scale campaign that’s targeting Brazilian users with a WhatsApp worm dubbed SORVEPOTEL that’s used to distribute a banking trojan codenamed Maverick.\\n\\nFound this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.\\n”,”published”:”2025-10-20T10:47:00″,”modified”:”2025-10-20T10:47:51″,”type”:”thn”,”title”:”131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign”,”source”:””,”references”:””,”id”:”THN:CD633B7351B452B86AEEEDCB256410EC”,”bulletinFamily”:”info”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/thehackernews.com\/2025\/10\/131-chrome-extensions-caught-hijacking.html”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-20T10:47:59″,”description”:”\\n\\nCybersecurity researchers have uncovered a coordinated campaign that leveraged 131 rebranded clones of a WhatsApp Web automation extension for Google…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,13,33,7,11,43,5],"class_list":["post-22383","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-tapic","tag-thn","tag-vulnerability"],"yoast_head":"\n