Win7max - CRM no WhatsApp Web, Chatbot, Automação e Disparo em Massa

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Win7max pitches itself as a CRM layer for WhatsApp Web: chat organisation, chatbot automation and bulk sending. The extension ships a large content-script bundle under content/assets/js/, with files named like v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28924.js, plus a background.js and a second asset tree under funnil/assets/js/. 1186 findings were recorded, but the headline numbers mislead. No malware or malware-signature rules matched anything (both counts are zero), and every one of the 754 code-smell hits is low severity.

The network findings describe ordinary library behaviour. NET-SOCKET_IO appears in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and in ...149.js, NET-FETCH in several content scripts and at background.js:137, and NET-JQUERY_AJAX in ...23.js and ...24.js. A chat CRM that mirrors WhatsApp conversations needs a persistent socket, a fetch helper and jQuery's AJAX wrapper. Those detections record which transport the code uses; they do not say where data goes. There is a single manifest-analysis finding and nothing resembling a hijacked search path, a new-tab replacement or a credential extractor aimed at login pages.

The endpoint list is the clearest sign of extractor noise. Entries include above.sm, below.sm, btn.glass, border.radius.circle, color.border.accent.orange and calls.function.arguments.delta. Those are CSS and design-token strings, a streaming API event name and UI vocabulary, not hosts. The Atlassian and Statsig entries (api.dev.atlassian.com, api.statsigcdn.com, atlassian-isolated.net) come from bundled npm packages. None of these strings behaves like a command-and-control list.

Two obfuscation flags deserve a mention. OBFUSCATION-LARGE_BASE64 fires on funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and OBFUSCATION-FUNCTION_INDIRECT on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. A minified webpack or esbuild chunk with an inlined base64 asset trips both heuristics, and neither sits in the same file as a malware signature.

A skeptic would point at the manifest. The permission arrays are blank, and a tool that reads and sends WhatsApp messages has to declare host access to web.whatsapp.com, so the empty lists point to a parsing gap rather than a genuinely permission-less extension. The publisher is an email address ([email protected]), not a recognised vendor, and bulk senders sit in terms-of-service grey territory. None of that turns library detections into malicious code. What we can see does what the name promises: it talks to WhatsApp and to a socket backend. A corrected manifest parse would firm up the picture, but the code itself shows no harmful behaviour.

Key Reasons

• Zero malware and zero malware-signature findings across 1186 results
• Network findings (NET-SOCKET_IO, NET-FETCH, NET-JQUERY_AJAX) reflect normal transport library usage in a chat CRM
• Reported endpoints are CSS design tokens and API event strings misread as hosts, not real servers
• Obfuscation flags are minified-bundle and inlined-base64 heuristics with no malware signature in the same file
• No search-hijack, new-tab replacement, cookie exfiltration or credential-targeting indicators

False Positive Considerations

• 754 low-severity code-smell findings with zero malware signatures
• 407 IoCs extracted from minified bundles, including CSS tokens and API event names misread as domains
• Network findings are standard socket.io, fetch and jQuery AJAX library usage
• Bundled npm dependencies (Atlassian design tokens, Statsig SDK) contributing endpoint noise

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 74%.