Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →
Also reported by malext.io, reddit.com
SECRETARIA PRO CRM
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 4 days ago
- Version
- v7.4.3.87
- Artifact
- SHA256 891…7AF
- Source
- Findings (non-IoC)
Is SECRETARIA PRO CRM safe?
“SECRETARIA PRO CRM” says it adds CRM features to WhatsApp Web. The extension metadata lists no permissions and no host permissions, while the endpoint list includes api.dev.atlassian.com and api.atlassian-us-gov-mod.com. Its background code also has network findings at background.js:52:0, background.js:63:0, and background.js:137:0, so the service contacts need a clear link to the CRM’s stated job.
The strongest technical flags are NET-SOCKET_IO-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js-15, which records WebSocket-style communication from a content asset, and OBFUSCATION-LARGE_BASE64-funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js-1, which records a large encoded value. If those paths send WhatsApp content to an unrelated service, that would be a serious privacy issue.
The available matches include no malware signature, and several listed endpoints are code fragments such as border.radius.circle and color.text.accent.orange. Those strings explain some scanner noise. The unexplained sockets, fetch calls, and encoded asset still need runtime tracing and payload inspection before this extension can be treated as safe.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
16 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | credential env files | 30 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28927.jswhatsapp/wpp/index.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289266.js +27 more | - |
| LOW | postinstall persistence mechanism | 19 | whatsapp/wpp/index.jsfunnil/assets/css/style.cssfluxo/assets/css/style.css +16 more | - |
| LOW | ServerHostnameNotVerified | 1 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289.js | - |
| LOW | LocalStorageShouldNotBeUsed | 15 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28927.jsfunnil/assets/js/68038811-0075-484f-8b19-297df42f51e1.CVYXH02z.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28952.js +12 more | - |
| LOW | postinstall file download | 55 | fluxo/assets/js/index.tgWUt5OI.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289195.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2895.js +52 more | - |
| LOW | NoUseEval | 1 | whatsapp/wpp/index.js | - |
| LOW | NoUseWeakRandom | 38 | crm/assets/js/81588378-4894-485b-a1a7-52b1571a56a9.B9qdt_GQ.jsfluxo/assets/js/b89d7b82-41f7-4061-9bc0-ae95ae5cd0a2.BLiJgZ4E.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28914.js +35 more | - |
| LOW | SQLInjection | 1 | fluxo/index.js | - |
| LOW | postinstall environment access | 111 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2894.jscrm/assets/js/index.C_YPtVeo.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2897.js +108 more | - |
| LOW | postinstall network communication | 94 | funnil/index.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28936.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28935.js +91 more | - |
| LOW | OriginsNotVerified | 5 | funnil/assets/js/770d23cd-9021-4aef-887e-d47811b5c322.B8_nURbH.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2896.jsfluxo/index.js +2 more | - |
| LOW | postinstall crypto operations | 44 | fluxo/assets/js/modal.C4gLhAPo.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28939.jsfluxo/assets/js/modal.DwnKkzRB.js +41 more | - |
| LOW | postinstall system command | 77 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28929.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28927.jsfunnil/assets/js/cd52f586-58a7-445a-a045-5f4032b22b71.qLgWFQJ-.js +74 more | - |
| LOW | postinstall obfuscation | 83 | fluxo/assets/js/index.DUxSI4v-.jsfluxo/assets/js/index.tgWUt5OI.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28975.js +80 more | - |
| LOW | postinstall registry modification | 8 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2895.jsfunnil/assets/js/68038811-0075-484f-8b19-297df42f51e1.CVYXH02z.jscrm/assets/js/5e35787c-36b2-4a56-8ea4-4e0a75aa6943.D2Np3EBj.js +5 more | - |
| LOW | postinstall file manipulation | 172 | crm/assets/js/index.C3nosisq.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28968.jscrm/assets/js/index.Jx-nDzeN.js +169 more | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
16 rules(754 hits)Requested Permissions
5 permissionsAI Security Report
AI Security Review
Evidence context: threat category data exfiltration; evidence quality moderate.
“SECRETARIA PRO CRM” is described as a CRM that adds features to WhatsApp Web, yet background.js:52:0, background.js:63:0, and background.js:137:0 contain network findings without descriptions or named destinations. Content scripts also trigger NET-SOCKET_IO-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js-15 and related Socket.IO findings in content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1146.js:64:0 and content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1170.js:37:0. A CRM can have valid reasons to contact a service, but these paths show persistent network mechanisms without enough context to establish what WhatsApp data is sent or why.
The endpoint list contains ordinary-looking Atlassian service names such as api.dev.atlassian.com and api.statsigcdn.com, alongside api.atlassian-us-gov-mod.com, api.stg.atlassian-us-gov-mod.com, and atlassian-isolated.net. The latter names require validation because their relationship to a WhatsApp CRM is not established by NET-FETCH-background.js-52 or NET-FETCH-background.js-63. Other listed values, including border.radius.circle, btn.glass, and color.text.accent.orange, match CSS or code fragments rather than useful domains, so the endpoint list alone cannot prove hostile communication.
Two medium-severity findings deserve direct inspection. OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js-1 identifies indirect function use in a content asset, while OBFUSCATION-LARGE_BASE64-funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js-1 identifies a large Base64 value in a funnil asset. These titles do not show what the code does. The available findings include no malware-signature match, and the evidence lists no credential-theft or tool-poisoning finding, so the material does not support a malicious verdict by itself.
The strongest counterargument is that the network and obfuscation signals come from bundled application code. The repeated content/assets/js/v_7_4_3_84_*.js paths and the funnil/assets/js/...js path fit a packaged web application, and the endpoint values calls.function.arguments.delta and color.icon.accent.orange show that extraction also captured non-domain strings. That explains some noise, yet it does not resolve the unexplained Socket.IO calls in content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js:15 or the Base64 payload in funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js:1. Runtime inspection should trace those calls and decode the payload before installation trust is decided.
Key Reasons
background.js:52:0,background.js:63:0, andbackground.js:137:0contain network findings without destination or purpose descriptions.- Socket.IO findings occur in content assets, including
content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js:15. OBFUSCATION-LARGE_BASE64-funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js-1requires payload inspection.- The endpoint list includes
api.atlassian-us-gov-mod.com, which is unrelated to the stated WhatsApp CRM purpose on the available evidence. - No malware-signature finding is listed, and several endpoint values are code or CSS fragments.
False Positive Considerations
- Bundled JavaScript paths under
content/assets/js/can create repeated network findings. funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.jsis a packaged asset where encoded data can be application content.- Endpoint values such as
border.radius.circleandcolor.text.accent.orangeare code fragments rather than domains. - Generic code-smell and IoC volume is not evidence of malicious intent.
Reviewed 2026-09-29; recommended action: runtime analysis; model confidence 72%.
Chrome version history
Risk trend by version
12 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
waSuper
[email protected]
Wa Elo IA
[email protected]
Whapro – Automação, CRM e Vendas no WhatsApp Web
[email protected]
Vende+
[email protected]
WaListall | O Melhor CRM para WhatsApp Web – Teste Grátis
[email protected]
InfiChat
[email protected]