Organize-C Pro

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Organize-C Pro is a Portuguese-language WhatsApp sales tool. Its listing says it organises contacts, sends messages and automates replies, and version 7.4.3.87 ships about twenty JavaScript chunks in content/assets/js/, each named with a build UUID such as v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js. The publisher is listed as [email protected], an address on a domain that resells extensions, with no company name attached.

The findings that drive the score are about the shape of the code. Fifteen chunks in content/assets/js/ fire NET-FETCH, NET-JQUERY_AJAX and NET-SOCKET_IO, and background.js:137 fires NET-FETCH in the service worker. Those three rules match fetch(), $.ajax() and socket.io wherever they occur, so they land on almost any bundled front-end. A tool that syncs contacts and queues with a remote dashboard needs exactly this plumbing. The problem is that no destination is recorded for any of it, so the scan cannot say whether the traffic goes to the vendor's own API or somewhere else.

The two obfuscation hits are the only ones that warrant a second look. OBFUSCATION-LARGE_BASE64 fires at funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1, which holds a block of base64 text, and OBFUSCATION-FUNCTION_INDIRECT fires at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js:1. Bundlers inline fonts, images and vendor blobs as base64 all the time, and minifiers call functions through variables as a matter of course, so both patterns are ordinary on their own. What the blob in the funnil file decodes to is not answered anywhere in what we have.

Everything else came back clean. No malware signatures, no threat-intelligence indicators, no code-smell rules, no exposed secrets, no dependency findings. For 23 flagged items to include zero malware signatures is the most useful fact in the scan: cookie theft, proxyware and dropper behaviour all leave traces that this analysis did not produce.

A skeptic would look at the anonymous publisher address, a socket.io channel to an unnamed server and a base64 blob, and call this a staged remote payload aimed at 280 WhatsApp users. That reading is reasonable on its face. It fails on the missing half: there is no signature, no indicator, no credential access and no named destination anywhere in the findings. Every network hit maps to a known framework rule, which is what noise looks like. The absence of a recorded endpoint is also why this is not an all-clear. Reaching the socket.io server or the fetch target in background.js would settle it, and so would the manifest permissions, which were not captured.

Key Reasons

• All 23 findings are medium severity with zero malware signatures, zero IoCs, zero code-smell rules and zero secret findings.
• The 22 network hits are framework-level rules (NET-FETCH, NET-JQUERY_AJAX, NET-SOCKET_IO) spread across UUID-named bundle chunks in content/assets/js/ and one service-worker line at background.js:137.
• OBFUSCATION-LARGE_BASE64 at funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1 is unexplained by the evidence and is the single item worth decoding.
• permissions and host_permissions are both empty, so the extension's actual reach into web.whatsapp.com is not established.
• No destination domain is recorded for any outbound connection, leaving the socket.io channel unverified.

False Positive Considerations

• Minified and bundled JavaScript under content/assets/js/ triggers jQuery Ajax, Socket.IO and fetch network rules because those rules match framework calls wherever they appear.
• LARGE_BASE64 and FUNCTION_INDIRECT both fire on ordinary bundler and minifier output rather than on deliberate packing.
• Finding volume is inflated by many similarly named UUID build chunks, each producing its own version of the same network rule.
• No IoC, malware-signature, code-smell, secret or dependency findings accompany the network and obfuscation hits.

Reviewed 2026-10-15; recommended action: runtime analysis; model confidence 62%.