Flagged in the threat library: WaSteal

Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →

Also reported by malext.io, reddit.com

Chrome Web Store Verified

Bull Lead - Automações e atendimento no WhatsApp para vendedores

by [email protected] · 41 users · 5.0 rating
3f38ac9c-106b-5175-9367-3ed2ae274fb5 | v7.4.3.87
65/ 100
MEDIUM risk
No change since v7.4.3.85
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
4 days ago
Version
v7.4.3.87
Artifact
SHA256 DAB…B6D
Source
Findings (non-IoC)

Is Bull Lead - Automações e atendimento no WhatsApp para vendedores safe?

Bull Lead declares no permissions or host permissions. Its recorded endpoints include api.atlassian-us-gov-mod.com, atlassian-isolated.net, and api.statsigcdn.com, while background.js:52:0 and background.js:63:0 contain fetch activity. The content files named by NET-SOCKET_IO-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js-15 show live socket connections, which fits a WhatsApp CRM that syncs work data.

Two code findings need a closer look. OBFUSCATION-LARGE_BASE64-funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js-1 identifies a large encoded block, and OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js-1 identifies indirect function use. If those parts send chat data or login material to the Atlassian-themed domains, the behavior would be unsafe.

The scanner also recorded no malware-signature matches and no special permissions. Versioned content assets can contain packed libraries, so the encoded block and network code can have a normal software explanation. The specific domains still need runtime checks because the supplied findings do not show which payloads leave the browser.

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

779 detail rows

YARA Rule Matches

16 rules
SeverityRuleHitsFilesMetadata
LOWServerHostnameNotVerified 1
content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289.js
-
LOWLocalStorageShouldNotBeUsed 15
content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289128.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28952.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28927.js +12 more
-
LOWpostinstall file download 55
fluxo/assets/js/emoji-picker-react.esm.LrTXoimj.jsfluxo/assets/js/b89d7b82-41f7-4061-9bc0-ae95ae5cd0a2.BLiJgZ4E.jsfunnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js +52 more
-
LOWNoUseEval 1
whatsapp/wpp/index.js
-
LOWNoUseWeakRandom 38
funnil/assets/js/comp.DyHpIB2X.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28922.jscrm/assets/js/comp.CnW8ZOTm.js +35 more
-
LOWSQLInjection 1
fluxo/index.js
-
LOWpostinstall environment access 111
content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28966.jsfluxo/assets/js/showAudio.8rzWFlz_.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js +108 more
-
LOWpostinstall network communication 94
content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289175.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289225.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28940.js +91 more
-
LOWOriginsNotVerified 5
crm/assets/js/b3c3d2a2-f432-4ecd-a3f4-0b4582cc4a6c.B8_nURbH.jsfluxo/assets/js/b89d7b82-41f7-4061-9bc0-ae95ae5cd0a2.BLiJgZ4E.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2896.js +2 more
-
LOWpostinstall crypto operations 44
crm/assets/js/modal.DGPvvr-c.jscrm/assets/js/5e35787c-36b2-4a56-8ea4-4e0a75aa6943.D2Np3EBj.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js +41 more
-
LOWpostinstall system command 77
content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28937.jscrm/assets/js/22224ae4-c9a0-456b-97d3-6f47a43e6f69.cO50aLre.jsfluxo/assets/css/style.css +74 more
-
LOWpostinstall obfuscation 83
content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289255.jscrm/assets/js/22224ae4-c9a0-456b-97d3-6f47a43e6f69.cO50aLre.jscrm/assets/js/menu.DqfxP1-O.js +80 more
-
LOWpostinstall registry modification 8
crm/assets/js/b15575b9-e8eb-4d64-83b8-37d47f2b0b0a.BbRllemT.jsfunnil/assets/js/68038811-0075-484f-8b19-297df42f51e1.CVYXH02z.jscrm/assets/js/5e35787c-36b2-4a56-8ea4-4e0a75aa6943.D2Np3EBj.js +5 more
-
LOWpostinstall file manipulation 172
content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289193.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28920.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289132.js +169 more
-
LOWcredential env files 30
content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2899.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289163.jscrm/assets/js/b3c3d2a2-f432-4ecd-a3f4-0b4582cc4a6c.B8_nURbH.js +27 more
-
LOWpostinstall persistence mechanism 19
crm/assets/js/22224ae4-c9a0-456b-97d3-6f47a43e6f69.cO50aLre.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289195.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289128.js +16 more
-

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

51
Noisy-finding weight
x1.00
Publisher domain
extensao.store
Observed
Store verification signal
Limited signal
Limited
Extension portfolio
174
Portfolio

11 evidence rows available.

Finding Categories

2
Obfuscation
22
Network
418
IoC Indicators

YARA Rules Matched

16 rules(754 hits)
ServerHostnameNotVerified LocalStorageShouldNotBeUsed postinstall file download NoUseEval NoUseWeakRandom SQLInjection postinstall environment access postinstall network communication OriginsNotVerified postinstall crypto operations postinstall system command postinstall obfuscation postinstall registry modification postinstall file manipulation credential env files postinstall persistence mechanism

Requested Permissions

5 permissions
tabs
Medium
unlimitedStorage
Low
storage
Low
alarms
Low
https://web.whatsapp.com/*
Low

AI Security Report

AI Security Review

Evidence context: threat category unknown malware; evidence quality moderate.

The extension is presented as a WhatsApp Web CRM, and the network findings fit that stated function in part. background.js:52:0, background.js:63:0, and background.js:137:0 contain fetch activity, while the content files named by NET-SOCKET_IO-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js-15 and NET-SOCKET_IO-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1146.js-64 contain Socket.IO activity. A customer-service or sales tool can have a valid reason to exchange chat and account data with a service backend.

The strongest concern is the endpoint set paired with code that is harder to inspect. The recorded endpoints include api.atlassian-us-gov-mod.com and atlassian-isolated.net, which use Atlassian-related naming without evidence here that the extension is made by Atlassian. The endpoint list also includes api.dev.atlassian.com and api.stg.atlassian.com, so some Atlassian traffic could belong to development or integration libraries. The files content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js:1:0 and funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js:1:0 trigger OBFUSCATION-FUNCTION_INDIRECT and OBFUSCATION-LARGE_BASE64. Those titles identify indirect function use and a large encoded block, yet they do not prove that the block carries harmful code.

The available results contain no malware-signature match. They also contain no secret finding, no tool-poisoning finding, and no host permissions. Those facts reduce support for credential theft or broad browsing surveillance. The network titles NET-FETCH-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a125.js-8 and NET-JQUERY_AJAX-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a121.js-13 show outbound request mechanisms, though the supplied titles do not show the request data or final destinations.

A skeptic could say the suspicious endpoint names and encoded JavaScript come from bundled dependencies. That argument has support in funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js:1:0, where a large Base64 block may be packaged application data, and in the many content asset paths that look versioned and bundled. The generic network titles also cannot show whether WhatsApp messages, tokens, or unrelated library data leave the browser. The concern remains because api.atlassian-us-gov-mod.com and atlassian-isolated.net are specific external names, while OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js-1 limits source review. Runtime tracing should identify each destination and payload before the extension is cleared.

Key Reasons

  • api.atlassian-us-gov-mod.com and atlassian-isolated.net are specific external endpoints with Atlassian-themed names.
  • OBFUSCATION-LARGE_BASE64-funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js-1 identifies a large encoded block.
  • OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js-1 limits source inspection.
  • background.js:52:0, background.js:63:0, and content asset files show fetch, AJAX, and Socket.IO activity.
  • No malware-signature matches or host permissions were supplied, so harmful intent is unproven.

False Positive Considerations

  • Versioned files under content/assets/js/ and funnil/assets/js/ may be bundled application dependencies.
  • OBFUSCATION-LARGE_BASE64 can match packed application data without proving malicious behavior.
  • Generic NET-FETCH, NET-JQUERY_AJAX, and NET-SOCKET_IO titles do not identify payload contents.
  • IoC extraction can mistake library strings and infrastructure names for meaningful destinations.

Reviewed 2026-09-29; recommended action: runtime analysis; model confidence 76%.

Chrome version history

Risk trend by version

16 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.

Selected
65
Change since first
+4
Change from previous
No change
Versions:
First analyzed version
7.4.3.51
Jun 15, 2026
Risk range
60 to 73
Across analyzed versions
Latest analyzed version
7.4.3.87
Oct 12, 2026
Selected version
medium
Version
v7.4.3.87
4 days ago
Risk score
65
Findings
1198
Change vs previous
No change

Pick any point on the chart to explore that version's code below.

About This Extension

Experimente as novas funcionalidades do Bull Lead, projetadas para oferecer mais controle sobre seus leads e aumentar suas prospecções de clientes. Com envios em massa e exportação de contatos. Principais Funcionalidades: ✔ Envio em massa para seus contatos ou contatos importados via CSV ✔ Criação de abas personalizadas para fácil localização de contatos importantes ✔ Visão Kanban para organizar seus leads ✔ Envio de mensagens para números não salvos na agenda ✔ Notas personalizadas para cada contato ✔ Criação de lembretes para retornar ligações ✔ Agendamento de reuniões no Google Agenda ✔ Configuração de lembretes simples com notificações ✔ Banco de respostas rápidas para envio com um clique ✔ Exportação de todos os contatos de grupos ✔ Suporte a múltiplos idiomas (português, espanhol, inglês) ✔ Função de borrar mensagens para criação de vídeos tutoriais. ✔ Assistente AI — Sua inteligência artificial pronta para ajudar! Otimize seu tempo com um assistente inteligente, rápido e sempre disponível. Responda dúvidas, automatize tarefas, gere textos, traduções e muito mais com o poder da IA. Ideal para profissionais, equipes e quem busca praticidade no dia a dia. Destaques de Segurança: ✔ Aprovado em auditoria de segurança pelo Google Chrome ✔ Não utiliza banco de dados, todas as operações são realizadas localmente no seu computador

Frequently Asked Questions

Similar Extensions

Related extensions from the same publisher or marketplace

waSuper

[email protected]

MEDIUM 6 users

Wa Elo IA

[email protected]

MEDIUM 99 users

Whapro – Automação, CRM e Vendas no WhatsApp Web

[email protected]

MEDIUM 1K users

Vende+

[email protected]

MEDIUM 12 users

WaListall | O Melhor CRM para WhatsApp Web – Teste Grátis

[email protected]

MEDIUM 36 users

InfiChat

[email protected]

MEDIUM 5 users