Altus Leads - WhatsApp Turbinado, mais vendas, menos esforço

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Altus Leads is a Brazilian CRM that runs inside WhatsApp Web. The extension ships content scripts plus a background page that talk to a backend over fetch and socket.io, which is the minimum a chat dashboard needs to show new messages without a page reload.

The network findings are library-shaped. NET-SOCKET_IO fires on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28966.js:1 and four sibling bundles. NET-JQUERY_AJAX fires on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js:1 and on the same file at line 181. NET-FETCH fires on background.js:137 and across roughly a dozen content bundles. Socket.io is a realtime transport and jQuery is a DOM library; a CRM that reads conversations and pushes them to a dashboard carries both. None of these findings tells us what is sent or where it goes.

The endpoint list is where the extractor visibly falls apart. It offers border.radius.circle, btn.glass, color.border.accent.orange and calls.function.arguments.delta as network destinations. Those are CSS custom property names and a JSON path from the OpenAI streaming delta format, scraped out of minified code. above.sm, ae.jobs and avatar.online are fragments of the same kind. The only entries with a plausible role in a chat product are app.wascript.com, a Brazilian WhatsApp automation service, and api.statsigcdn.com, a feature-flag CDN.

The two obfuscation findings describe build output. OBFUSCATION-LARGE_BASE64 points at funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1, and a base64 blob in a hashed webpack chunk is normally an inlined font or image. OBFUSCATION-FUNCTION_INDIRECT points at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js:1, which is what every JavaScript minifier produces. Across 1,201 findings there are no malware signatures, no secrets, no dependency alerts and no high or critical severities. The 754 code-smell matches are the usual noise on any bundled front end, and nothing in the set touches cookies, passwords or banking and social login domains.

A skeptic has a fair case. The extension runs on WhatsApp Web and reads conversations, it holds a socket.io connection to app.wascript.com with no host permissions declared in the copy we inspected, and its only publisher identity is the address [email protected] rather than a company. That is a real capability worth understanding, and it is the reason this is not a clean bill of health. What would settle it is the manifest's content_scripts matches and the exact connect URL and payload schema used by the fetch and socket.io calls. Until someone reads those, the honest reading of the evidence is that the scanner tripped on bundled libraries, minifier output and its own extractor, not on anything the extension did.

Key Reasons

• Zero malware signatures, zero malware, zero secrets and zero high or critical severity across 1,201 findings.
• All 22 network findings are library patterns: NET-SOCKET_IO, NET-JQUERY_AJAX and NET-FETCH across bundled content scripts and background.js:137.
• The endpoint list contains extractor garbage such as border.radius.circle, btn.glass and calls.function.arguments.delta, which are CSS property names and a JSON parse path.
• Both obfuscation findings, OBFUSCATION-LARGE_BASE64 and OBFUSCATION-FUNCTION_INDIRECT, describe webpack and minifier output rather than hand-written hiding.
• No credential, cookie, login-domain or browser-hijack findings, and the extension name does not mimic a known product.

False Positive Considerations

• IoC extractor garbage: CSS values and JS property chains reported as network endpoints
• Bundled dependencies: 754 code-smell matches in minified webpack chunks with no high or critical severity
• Minification misread as obfuscation: LARGE_BASE64 and FUNCTION_INDIRECT in hashed build output
• Network heuristics firing on standard fetch, jQuery AJAX and socket.io transport code

Reviewed 2026-10-11; recommended action: monitor; model confidence 72%.