VIUko

AI Security Review

Evidence context: threat category unknown malware; evidence quality moderate.

VIUko is a Firefox extension claiming to manage browser file downloads and sync them to a desktop application. The evidence presents a mixed picture requiring careful interpretation.

The 58 IoC findings are overwhelmingly false positives from the XIOC extractor. Generic TLD fragments like com.ph, co.jp, and com.au are known XIOC garbage that misread hex substrings from minified JavaScript as domains. Social media domains including instagram.com, tiktok.com, facebook.com, twitter.com, and x.com could be legitimate for a download manager that needs to detect downloads from these platforms. The nativemessaging permission in manifest.json aligns with the stated purpose of communicating with a desktop app.

However, one finding stands out as genuinely concerning: vivamax.net detected in extracted_from_files. Vivamax is an adult streaming platform with no obvious connection to file download management. This specific domain reference doesn't fit the extension's stated purpose and cannot be dismissed as a known false positive pattern.

Compounding the concern, the extension has an empty developer_name field, indicating an anonymous publisher. Combined with only 1 user and version 1.0.0, this suggests a newly published extension with minimal community validation. There are zero malware signatures, zero obfuscation findings, and zero code-smell findings, which would normally indicate a benign extension.

The strongest counterargument to flagging this extension is that 95% of findings are known false positives, and the extension lacks malware signatures or obfuscation. A skeptic would argue this is simply a download manager with noisy IoC detection. However, the vivamax.net reference combined with anonymous publication creates genuine uncertainty that cannot be resolved with static analysis alone. Runtime analysis would be needed to determine if the extension actually communicates with vivamax.net or if this is another XIOC false positive.

Without malware signatures or obfuscation, this doesn't meet the threshold for confirmed_malicious. But the anonymous publisher and unexplained domain reference prevent confident classification as likely_false_positive.

Key Reasons

• vivamax.net domain reference doesn't align with stated file download management purpose
• Anonymous publisher with empty developer_name field
• 58 IoC findings mostly from known XIOC false positive patterns (TLD fragments, social media domains)
• Zero malware signatures and zero obfuscation findings
• Only 1 user with version 1.0.0 suggests new/unvalidated extension

False Positive Considerations

• XIOC TLD fragment extraction (com.ph, co.jp, com.au)
• Social media domain references (instagram.com, tiktok.com, facebook.com, x.com, twitter.com)
• Manifest permission flags for nativemessaging and tabs

Reviewed 2026-05-31; recommended action: runtime analysis; model confidence 60%.