Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →
Also reported by malext.io, reddit.com
Bull Lead - Automações e atendimento no WhatsApp para vendedores
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 4 days ago
- Version
- v7.4.3.87
- Artifact
- SHA256 DAB…B6D
- Source
- Findings (non-IoC)
Is Bull Lead - Automações e atendimento no WhatsApp para vendedores safe?
Bull Lead declares no permissions or host permissions. Its recorded endpoints include api.atlassian-us-gov-mod.com, atlassian-isolated.net, and api.statsigcdn.com, while background.js:52:0 and background.js:63:0 contain fetch activity. The content files named by NET-SOCKET_IO-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js-15 show live socket connections, which fits a WhatsApp CRM that syncs work data.
Two code findings need a closer look. OBFUSCATION-LARGE_BASE64-funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js-1 identifies a large encoded block, and OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js-1 identifies indirect function use. If those parts send chat data or login material to the Atlassian-themed domains, the behavior would be unsafe.
The scanner also recorded no malware-signature matches and no special permissions. Versioned content assets can contain packed libraries, so the encoded block and network code can have a normal software explanation. The specific domains still need runtime checks because the supplied findings do not show which payloads leave the browser.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
16 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | credential env files | 30 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2899.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289208.jscrm/assets/js/b15575b9-e8eb-4d64-83b8-37d47f2b0b0a.BbRllemT.js +27 more | - |
| LOW | postinstall persistence mechanism | 19 | fluxo/assets/js/b89d7b82-41f7-4061-9bc0-ae95ae5cd0a2.BLiJgZ4E.jsfunnil/assets/js/68038811-0075-484f-8b19-297df42f51e1.CVYXH02z.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289128.js +16 more | - |
| LOW | ServerHostnameNotVerified | 1 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289.js | - |
| LOW | LocalStorageShouldNotBeUsed | 15 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289128.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2895.jswhatsapp/wpp/index.js +12 more | - |
| LOW | postinstall file download | 55 | fluxo/assets/ttf/Segoeui.chunk.ttfcontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289139.jsfluxo/assets/ttf/Segoeuibold.chunk.ttf +52 more | - |
| LOW | NoUseEval | 1 | whatsapp/wpp/index.js | - |
| LOW | NoUseWeakRandom | 38 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2896.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28922.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28925.js +35 more | - |
| LOW | SQLInjection | 1 | fluxo/index.js | - |
| LOW | postinstall environment access | 111 | fluxo/assets/js/aacac57f-f9a2-4a7d-9569-51c193124758.BUttUo7e.jscrm/assets/js/5e35787c-36b2-4a56-8ea4-4e0a75aa6943.D2Np3EBj.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28913.js +108 more | - |
| LOW | postinstall network communication | 94 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28929.jsfluxo/assets/js/emoji-picker-react.esm.LrTXoimj.jscrm/index.js +91 more | - |
| LOW | OriginsNotVerified | 5 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2896.jsfunnil/assets/js/770d23cd-9021-4aef-887e-d47811b5c322.B8_nURbH.jscrm/assets/js/b3c3d2a2-f432-4ecd-a3f4-0b4582cc4a6c.B8_nURbH.js +2 more | - |
| LOW | postinstall crypto operations | 44 | fluxo/assets/js/index.tgWUt5OI.jswhatsapp/wpp_module/index.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28922.js +41 more | - |
| LOW | postinstall system command | 77 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289166.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289186.jsfunnil/assets/js/1d2bb46d-fc90-4d3e-913e-6de868f5b92e.DeRmtv56.js +74 more | - |
| LOW | postinstall obfuscation | 83 | fluxo/assets/js/index.yTVEmsaG.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289171.js +80 more | - |
| LOW | postinstall registry modification | 8 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2895.js +5 more | - |
| LOW | postinstall file manipulation | 172 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289265.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289128.js +169 more | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
16 rules(754 hits)Requested Permissions
5 permissionsAI Security Report
AI Security Review
Evidence context: threat category unknown malware; evidence quality moderate.
The extension is presented as a WhatsApp Web CRM, and the network findings fit that stated function in part. background.js:52:0, background.js:63:0, and background.js:137:0 contain fetch activity, while the content files named by NET-SOCKET_IO-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js-15 and NET-SOCKET_IO-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1146.js-64 contain Socket.IO activity. A customer-service or sales tool can have a valid reason to exchange chat and account data with a service backend.
The strongest concern is the endpoint set paired with code that is harder to inspect. The recorded endpoints include api.atlassian-us-gov-mod.com and atlassian-isolated.net, which use Atlassian-related naming without evidence here that the extension is made by Atlassian. The endpoint list also includes api.dev.atlassian.com and api.stg.atlassian.com, so some Atlassian traffic could belong to development or integration libraries. The files content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js:1:0 and funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js:1:0 trigger OBFUSCATION-FUNCTION_INDIRECT and OBFUSCATION-LARGE_BASE64. Those titles identify indirect function use and a large encoded block, yet they do not prove that the block carries harmful code.
The available results contain no malware-signature match. They also contain no secret finding, no tool-poisoning finding, and no host permissions. Those facts reduce support for credential theft or broad browsing surveillance. The network titles NET-FETCH-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a125.js-8 and NET-JQUERY_AJAX-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a121.js-13 show outbound request mechanisms, though the supplied titles do not show the request data or final destinations.
A skeptic could say the suspicious endpoint names and encoded JavaScript come from bundled dependencies. That argument has support in funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js:1:0, where a large Base64 block may be packaged application data, and in the many content asset paths that look versioned and bundled. The generic network titles also cannot show whether WhatsApp messages, tokens, or unrelated library data leave the browser. The concern remains because api.atlassian-us-gov-mod.com and atlassian-isolated.net are specific external names, while OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js-1 limits source review. Runtime tracing should identify each destination and payload before the extension is cleared.
Key Reasons
api.atlassian-us-gov-mod.comandatlassian-isolated.netare specific external endpoints with Atlassian-themed names.OBFUSCATION-LARGE_BASE64-funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js-1identifies a large encoded block.OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js-1limits source inspection.background.js:52:0,background.js:63:0, and content asset files show fetch, AJAX, and Socket.IO activity.- No malware-signature matches or host permissions were supplied, so harmful intent is unproven.
False Positive Considerations
- Versioned files under
content/assets/js/andfunnil/assets/js/may be bundled application dependencies. OBFUSCATION-LARGE_BASE64can match packed application data without proving malicious behavior.- Generic
NET-FETCH,NET-JQUERY_AJAX, andNET-SOCKET_IOtitles do not identify payload contents. - IoC extraction can mistake library strings and infrastructure names for meaningful destinations.
Reviewed 2026-09-29; recommended action: runtime analysis; model confidence 76%.
Chrome version history
Risk trend by version
16 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
waSuper
[email protected]
Wa Elo IA
[email protected]
Whapro – Automação, CRM e Vendas no WhatsApp Web
[email protected]
Vende+
[email protected]
WaListall | O Melhor CRM para WhatsApp Web – Teste Grátis
[email protected]
InfiChat
[email protected]