← Campaigns

WaSteal

A white-label WhatsApp Web CRM platform (internal name watidy) published under dozens of independent-looking Brazilian brands. Every variant shares one codebase, one backend (*.wascript.com.br) and one platform key, silently uploads voice notes for server-side conversion, exfiltrates PII plus Facebook/Google/TikTok advertising cookies to per-reseller webhooks every 24 hours, and loads runtime JavaScript from actor-controlled hosts - including a live Google Tag Manager container in WaSeller that is a permanent remote-code channel. Independently verified against CVEQ archives 2026-08-22.

Extensions
154
Stores
Chrome
Updated
2026-10-27
Disclosed
2026-05-13

Member extensions

154 extensions
Campaign member extensions and their current risk
ExtensionStoreReported versionsCurrent risk
Econectada - CRM WhatsApp WeblaahjimkfmcdknlcmpdlndipjiaklgjjChromeNot specified0MINIMAL
EddyeabpcbpoghgmfjkkdoeknbldhkklpcmfnChromeNot specified64.99MEDIUM
SmartZaplecapbnkojjbcmpgojanclnilcnemjpkChromeNot specified0MINIMAL
UpSelllfenojckeamfnllggndghkmfhkheiimcChromeNot specified64.99MEDIUM
ELITEpcpdnigabekdogbajcacpbkebdfmaapcChromeNot specified64.99MEDIUM
WhatsSellingbdcoljfgfbdkmjeabhnpgddpiopccleoChromeNot specified0MINIMAL
BootCompkmipafdabbpmampkcconideakdacmalnChromeNot specified64.99MEDIUM
Feel UpokhjgjpafhnjbndkojddaicngefobnjnChromeNot specified64.99MEDIUM
FATURE MAISghfhbalboihigmncnabikapdldfdikngChromeNot specified53.37MEDIUM
Cliente FlowdpahdbhekfclimkekdabboefohagelfpChromeNot specified0MINIMAL
Altus Leads - WhatsApp Turbinado, mais vendas, menos esforçojloncnggofbpceamlmbpchpkhdkejcbiChromeNot specified64.99MEDIUM
autozai – Otimize o tempo e multiplique as vendas no WhatsApphknmlgmbiononigjnihhflhmmmhfbjplChromeNot specified64.99MEDIUM
WaMedendfahndaiibchcbfaphnhanpckdhmllChromeNot specified0MINIMAL
WACRMbgaaamckjapoiaiioklgmbknjegdkkhdChromeNot specified57.76MEDIUM
Acelere CRMmahgiheajijdifhnekeknnkfkjbfjkdhChromeNot specified53.37MEDIUM
Bull Lead - Automações e atendimento no WhatsApp para vendedoresligmikomohkaooecoochfknopalblanlChromeNot specified64.99MEDIUM
Rhino CRMlfmanjgjccjkajbppaccimngmgfkoplfChromeNot specified53.37MEDIUM
MULTIZAP CRMbgnkgembgfkfjipflkniiibgcedloeknChromeNot specified53.37MEDIUM
Lightiius CRMohkakacjaddkccagpciddgcjjbbpcgflChromeNot specified53.37MEDIUM
DGUESTSephepidhbiabcalednafkdpllnnohnphChromeNot specified64.99MEDIUM

Indicators

Download STIX →
Browse 28 indicators
TypeValue & evidence
sha256224ebdc0970a8f979552d21be1eeca528a679d5a4449364c0189e9dd7318906bfull CRX, analysed build archived in R2 (MAGNET CRM - El imán que atrae y gestiona tus cleintes. 2.5.2)
sha2565b17b29014e456d644f6faf60b02e9a99426098b3d756f976f009f63245d57d5full CRX, analysed build archived in R2 (WAFACIL 7.4.3.85)
sha2564e48a03b314eb5d7a1c378818bab4f90a904df9b2cf3021840afcf35fa53c5fcfull CRX, analysed build archived in R2 (WAEVO 7.4.3.84)
sha25641ab3d1bb699c9d2356ae6796c23f6468f123ef8597eb6135e8d05651716b036full CRX, analysed build archived in R2 (WATHOR 7.4.3.84)
sha256eadded40d1939c472dee2fc7c97ef3b59f2469b9e91c63149e0b8505f14797e4full CRX, analysed build archived in R2 (Dental Chat 7.4.3.84)
domainwascript.com.brplatform backend parent - all variants
domainbackend-plugin.wascript.com.brC2 / remote service-update endpoint
domainbackend-utils.wascript.com.brvoice-note upload + PII webhook backend
urlhttps://backend-utils.wascript.com.br/api/audio/convert-ptt-base64every voice note transits this endpoint before delivery
domaincode.wascript.com.brremote config origin: config.json sets which WhatsApp Web elements are read and where session data is posted; its remote_code URL is not loaded by build 7.4.3.84
domainpainel-old.wascript.com.brlegacy operator panel
domainapp.wascript.com.broperator client panel
domainnew-multi-atendimento.wascript.com.brmulti-agent live channel
domainapi-whatsapp.wascript.com.brWhatsApp API bridge
domainmeta-oficial.wascript.com.brofficial-account integration frontend
domaindev.watools.com.brsatellite brand backend ([email protected])
domainextractleads.com.brruntime JS injection origin (header/body/footer.js)
urlhttps://extractleads.com.br/teste/header.jsserver-side template injecting FB Pixel/GTM into panel pages
domainstatic-files.watidy.com.bralternate runtime JS origin
ext_idillemhbijpiebjfilfmgebahaakajkpeWaSeller flagship, 100k installs, carries live GTM container GTM-KMZ9CZK
otherGTM-KMZ9CZKlive Google Tag Manager container = persistent remote-code channel in WaSeller
otherffce211a-7b07-4d91-ba5d-c40bb4034a83shared platform cript_key hardcoded in every analyzed build
other8fd5ad24df1e1b800d670e563b1b83591980060a==obfuscated localStorage throttle key gating the 24h cookie-exfil timer
sha2561332b2d10c066a1475271cce6ca3869eb3dac181d4ce752aa217f7d569e7906dfull CRX, verified build held in R2 quarantine (WaSeller - Perder vendas no )
sha2561101eddffdea9909285f77f661a3c8a92f78b3bfc86757dc32ae11ec1ad520e8full CRX, verified build held in R2 quarantine (WaSpeed)
sha256db2ee4ca226446532804b51ab340a90715e8050f2795bf589f20206fb8cde543full CRX, verified build held in R2 quarantine (waTidy )
sha256bd835ee107a726a240e77dcae825189ee0f69f8130046eff04987a1ead480261full CRX, verified build held in R2 quarantine (WhaScale - Um passo à frente)
sha256bbb493b87935e7fb1a85097d053f3ac0ce322a7ebfc6a8376327129bb45d5711full CRX, verified build held in R2 quarantine (Whapro)

Research & sources

Read the investigation →