Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →
Also reported by malext.io, reddit.com
waCluster : Organize, automatize e decole nas vendas
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 3 days ago
- Version
- v7.4.3.87
- Artifact
- SHA256 E21…D76
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
Requested Permissions
5 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The extension waCluster presents itself as a WhatsApp Web CRM for organizing chats and automating sales tasks. The evidence shows 21 network findings across background.js and multiple content script files in content/assets/js/ with versioned hashed filenames (v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js, etc.), plus two obfuscation findings in content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js (FUNCTION_INDIRECT) and funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js (LARGE_BASE64). No malware signatures, IOCs, credential theft patterns, or browser hijacking indicators appear in the findings. The developer email [email protected] matches the product domain, and the extension declares no host permissions or special permissions. The network findings correspond to expected CRM backend communication for a WhatsApp Web automation tool, while the obfuscation findings appear in minified/bundled asset files typical of commercial JavaScript products. The low user count (21) reflects a niche or new extension rather than malicious distribution.
Key Reasons
- No malware signatures or suspicious IOCs detected
- Network findings align with legitimate CRM backend communication
- Obfuscation findings in minified/bundled commercial assets
- Developer identity matches product domain (wacluster.com)
- No credential theft, browser hijack, or proxyware indicators
False Positive Considerations
- network_findings_in_bundled_assets
- obfuscation_in_minified_commercial_code
- low_user_count_niche_product
Reviewed 2026-09-30; recommended action: suppress false positive; model confidence 82%.
Chrome version history
Risk trend by version
12 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
waCluster : Organize, automatize e decole nas vendas
[email protected]
种草星球-TikTok爆单神器,商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]
Open Headers
[email protected]
100xBot
[email protected]
Rook
[email protected]