← Campaigns

WaSteal

A white-label WhatsApp Web CRM platform (internal name watidy) published under dozens of independent-looking Brazilian brands. Every variant shares one codebase, one backend (*.wascript.com.br) and one platform key, silently uploads voice notes for server-side conversion, exfiltrates PII plus Facebook/Google/TikTok advertising cookies to per-reseller webhooks every 24 hours, and loads runtime JavaScript from actor-controlled hosts - including a live Google Tag Manager container in WaSeller that is a permanent remote-code channel. Independently verified against CVEQ archives 2026-08-22.

Extensions
154
Stores
Chrome
Updated
2026-10-27
Disclosed
2026-05-13

Member extensions

154 extensions
Campaign member extensions and their current risk
ExtensionStoreReported versionsCurrent risk
DR.FIDELIZAbijckmbmblabepobmabjcegimlcpilmlChromeNot specified64.99MEDIUM
VluwnddkllhdjjgopaibekmobibbmoedkdmjChromeNot specified64.99MEDIUM
EaseZapjlplnjdjnhkdigmpooonjmjppdkahljhChromeNot specified35.68LOW
Ninja AdsokiccdcmkdhldgbclikganfldepocmmdChromeNot specified64.99MEDIUM
ENOCRM | Gestão de Leads no WhatsAPPjeicljefnlpdoblklfdephbpihhjgphfChromeNot specified35.68LOW
HARMONYmijgckjdimoofbfpaahpgfnmnbnaahheChromeNot specified53.37MEDIUM
D2CHATPROhdagfineacponepnaljjkkgjoddgpjldChromeNot specified0MINIMAL
SECRETARIA PRO CRMmlppajibiceecppikhklhekggfabohieChromeNot specified64.99MEDIUM
GmCrmmpbjfchndgabpbglafphfphelhffelkgChromeNot specified64.99MEDIUM
NPohlghhgckmkaflhepflfaghhidhbhgddChromeNot specified35.68LOW
RED Chat CRMjkflhidejcmhenikpjhidoofogahicjpChromeNot specified35.68LOW
ZAPARETOmkjmckhlecedggnpbefkgehebkickghdChromeNot specified64.99MEDIUM
WAPINnfhbefcgpghdaaebjafocolpadkdedefChromeNot specified64.99MEDIUM
TALKNEXUSkafolfcddfckcjockfmahogjkfeoibdfChromeNot specified35.68LOW
Zap MachinepfmiilkeiipiiibodoolglmbgpcchcglChromeNot specified53.37MEDIUM
WAVENDYabkolnpebgghiglkkdjcgjgbpnddmfmpChromeNot specified64.99MEDIUM
SPEEDYXcomknamophhecgmcchgcclmcodohlfapChromeNot specified0MINIMAL
DigitaZapmpmccehgdjojicnlcmmdoogohdamlfppChromeNot specified0MINIMAL
MERLIN BOTjkblcpmoooocmdcfjojdecccejlkicapChromeNot specified64.99MEDIUM
WATENDhkdbocoaofpdmbbgpimdkhcafenpkiknChromeNot specified35.68LOW

Indicators

Download STIX →
Browse 28 indicators
TypeValue & evidence
sha256224ebdc0970a8f979552d21be1eeca528a679d5a4449364c0189e9dd7318906bfull CRX, analysed build archived in R2 (MAGNET CRM - El imán que atrae y gestiona tus cleintes. 2.5.2)
sha2565b17b29014e456d644f6faf60b02e9a99426098b3d756f976f009f63245d57d5full CRX, analysed build archived in R2 (WAFACIL 7.4.3.85)
sha2564e48a03b314eb5d7a1c378818bab4f90a904df9b2cf3021840afcf35fa53c5fcfull CRX, analysed build archived in R2 (WAEVO 7.4.3.84)
sha25641ab3d1bb699c9d2356ae6796c23f6468f123ef8597eb6135e8d05651716b036full CRX, analysed build archived in R2 (WATHOR 7.4.3.84)
sha256eadded40d1939c472dee2fc7c97ef3b59f2469b9e91c63149e0b8505f14797e4full CRX, analysed build archived in R2 (Dental Chat 7.4.3.84)
domainwascript.com.brplatform backend parent - all variants
domainbackend-plugin.wascript.com.brC2 / remote service-update endpoint
domainbackend-utils.wascript.com.brvoice-note upload + PII webhook backend
urlhttps://backend-utils.wascript.com.br/api/audio/convert-ptt-base64every voice note transits this endpoint before delivery
domaincode.wascript.com.brremote config origin: config.json sets which WhatsApp Web elements are read and where session data is posted; its remote_code URL is not loaded by build 7.4.3.84
domainpainel-old.wascript.com.brlegacy operator panel
domainapp.wascript.com.broperator client panel
domainnew-multi-atendimento.wascript.com.brmulti-agent live channel
domainapi-whatsapp.wascript.com.brWhatsApp API bridge
domainmeta-oficial.wascript.com.brofficial-account integration frontend
domaindev.watools.com.brsatellite brand backend ([email protected])
domainextractleads.com.brruntime JS injection origin (header/body/footer.js)
urlhttps://extractleads.com.br/teste/header.jsserver-side template injecting FB Pixel/GTM into panel pages
domainstatic-files.watidy.com.bralternate runtime JS origin
ext_idillemhbijpiebjfilfmgebahaakajkpeWaSeller flagship, 100k installs, carries live GTM container GTM-KMZ9CZK
otherGTM-KMZ9CZKlive Google Tag Manager container = persistent remote-code channel in WaSeller
otherffce211a-7b07-4d91-ba5d-c40bb4034a83shared platform cript_key hardcoded in every analyzed build
other8fd5ad24df1e1b800d670e563b1b83591980060a==obfuscated localStorage throttle key gating the 24h cookie-exfil timer
sha2561332b2d10c066a1475271cce6ca3869eb3dac181d4ce752aa217f7d569e7906dfull CRX, verified build held in R2 quarantine (WaSeller - Perder vendas no )
sha2561101eddffdea9909285f77f661a3c8a92f78b3bfc86757dc32ae11ec1ad520e8full CRX, verified build held in R2 quarantine (WaSpeed)
sha256db2ee4ca226446532804b51ab340a90715e8050f2795bf589f20206fb8cde543full CRX, verified build held in R2 quarantine (waTidy )
sha256bd835ee107a726a240e77dcae825189ee0f69f8130046eff04987a1ead480261full CRX, verified build held in R2 quarantine (WhaScale - Um passo à frente)
sha256bbb493b87935e7fb1a85097d053f3ac0ce322a7ebfc6a8376327129bb45d5711full CRX, verified build held in R2 quarantine (Whapro)

Research & sources

Read the investigation →