Botzom – Vendas, CRM e Chatbot para WhatsApp

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Botzom is a Chrome extension that turns WhatsApp Web into a sales CRM: it reads and organizes chats and runs a chatbot. Version 7.4.3.87 lists 131 users and is published under [email protected], an address on a generic extension-hosting domain rather than a company site.

The raw finding count is 1,189, and almost all of it is scanner noise. 754 findings are code-smell rules and 410 are indicator extractions, two categories that fire on ordinary minified JavaScript and on hex fragments inside bundled code. Nothing in the set is a malware signature: malware-signature and malware both count zero, and there are no critical or high severity findings at all.

The 22 network findings are pattern matches on API usage, not destinations. NET-SOCKET_IO and NET-FETCH fire inside content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289*.js, and NET-JQUERY_AJAX fires in the same directory. Socket.io plus fetch is what a chat-sync backend looks like, and the extension's stated job is syncing WhatsApp conversations, so these detections match the advertised behavior of a chat-sync tool.

The endpoint list shows how noisy the extraction is. Entries like 'border.radius.circle', 'color.border.accent.orange', 'calls.function.arguments.delta', 'btn.glass' and 'above.sm' are CSS values and JavaScript property chains, not hosts. The recognisable hosts are infrastructure: api.atlassian.com and api.statsigcdn.com, the latter a feature-flag service. One third-party host, app.wascript.com, has no finding connecting it to data leaving the browser.

Two obfuscation findings round this out. OBFUSCATION-LARGE_BASE64 flags an embedded block in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and OBFUSCATION-FUNCTION_INDIRECT flags indirect calls in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. Embedded base64 assets and indirect dispatch are standard output from bundlers and minifiers. Neither file carries a malware signature, and treating obfuscation as malicious requires a signature in the same file.

The strongest argument against this verdict is capability. A WhatsApp CRM injects into web.whatsapp.com and can read every conversation a user has. If this extension were harvesting chats, we would expect either a signature-matched payload or a specific suspicious domain wired into the findings. Neither is present. The only external host beyond CDN and analytics infrastructure is app.wascript.com, and nothing in the evidence ties exfiltration to it. Access to messages is the product, and the network detections reflect the sync channel the product needs.

Key Reasons

• Zero malware signatures and zero critical or high severity findings across 1,189 results
• Network findings are API-usage pattern matches (NET-SOCKET_IO, NET-FETCH, NET-JQUERY_AJAX) inside content/assets/js/*.js and background.js, consistent with chat sync
• 754 code-smell and 410 IoC findings are documented noise categories; the endpoint list contains CSS tokens such as 'border.radius.circle' and 'btn.glass'
• Only infrastructure hosts (api.statsigcdn.com, api.atlassian.com) plus unconnected app.wascript.com appear among endpoints
• Both obfuscation findings are isolated base64 and indirect-call patterns in bundled JS with no co-located malware signature

False Positive Considerations

• Code-smell rules firing on minified and bundled JavaScript (754 findings)
• XIOC extractor misreading CSS values and JS property chains as domains (border.radius.circle, btn.glass, calls.function.arguments.delta)
• Generic API-usage detectors (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) that match any production frontend
• Bundled dist-style assets under content/assets/js/ producing multiplicative findings

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 72%.