← Campaigns
CaptainProducts
Long-clean Chrome extensions bought through developer-account handoffs, then updated to inject an ad banner beaconing to a throwaway Cloudflare Worker. Eight confirmed carriers (~560k installs); every banner funnels users to one clean 200k-install extension that is the network's real payout.
- Extensions
- 8
- Stores
- Chrome
- Updated
- 2026-09-25
- Disclosed
- 2026-07-05
Member extensions
8 extensions| Extension | Store | Reported versions | Current risk |
|---|---|---|---|
| Dark Mode Google Docsiabnclnclchijjckhdljmocghgmgnnii | Chrome | 4.9.68 | 85CRITICAL |
| Chatgpt PDF | Ask your pdfehfkleckcppfceemdamfiohancgjglhk | Chrome | 1.4.2, 1.4.6 | 85CRITICAL |
| VPN for Discordcpmminfjchfmlnoncniejplodncncoon | Chrome | 0.0.4, 0.0.8 | 85CRITICAL |
| Spell Checkfclhkdjekjcalnjjkoohgcgbgpihlahf | Chrome | 1.0.1, 1.0.6 | 85CRITICAL |
| HEIC to JPG Converterfhhnbmkllifmckbpacekbajjhhonakci | Chrome | 2.2, 2.6 | 85CRITICAL |
| Image Convertergjhalfmdneljejledkcljfeaapgppbhl | Chrome | 1.3, 1.6 | 85CRITICAL |
| AI Grammar Checkermkdobhlbckbmhkclkoagfgbnholndbcl | Chrome | 1.0.1, 2.0.0 | 85CRITICAL |
| Screen recorderaohfenpemkefcdchmonkodnkdnkejegd | Chrome | 3.1.12 | 85CRITICAL |
Indicators
Download STIX →Browse 8 indicators
| Type | Value & evidence |
|---|---|
| domain | ext-ads-mvp.captain-products.workers.devC2 beacon, impression/click telemetry |
| domain | captain-products.workers.devC2 parent (Cloudflare Worker) |
| domain | text.ruaffiliate landing (RU-targeted) |
| domain | jivo.ruaffiliate partner_id=49587 |
| domain | nethouse.ruaffiliate landing (RU-targeted) |
| ext_id | molkadplffcfnfaaapdlhionhggonekmDark Mode Chrome, cross-promo destination |
| ext_id | apnedodbofogffiagpekmbeflilkcbgfYouTube To Text, 200k-install beneficiary (clean package) |
| sha256 | 2f66c07a4ec0fa85a4e122bb33eb88faca302fa43e1dd44965e64023cbb46fa2banner.png, Dark Mode Google Docs 4.9.68 popup ad image |