Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →
Also reported by malext.io, reddit.com
WANQUEST - CONECTE, AUTOMATIZE E CRESÇA
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 2 weeks ago
- Version
- v7.4.3.417
- Artifact
- SHA256 A77…576
- Source
- Findings (non-IoC)
Is WANQUEST - CONECTE, AUTOMATIZE E CRESÇA safe?
WANQUEST says it is a CRM for WhatsApp Web. This extension declares no special permissions, and no network endpoints are listed. Its background code does make web requests, however: NET-FETCH-background.js-52 points to background.js:52:0, with similar request findings at background.js:63:0 and background.js:137:0.
For a CRM, live network traffic can be normal. The scanner also found Socket.IO in content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js:15:0, which is commonly used for live updates. The unresolved part is OBFUSCATION-LARGE_BASE64 in funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js:1:0. If that encoded content handled chats, contacts, or login data in hidden ways, it would matter.
No listed finding identifies a malware family, a credential-stealing target, a proxy service, or a browser search takeover. The scanner tripped on request functions, Socket.IO, indirect function use, and a large encoded value. Capturing the destinations and contents of the requests from background.js:52:0, then decoding the value in funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js:1:0, is needed to determine what data leaves the browser.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
16 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | ServerHostnameNotVerified | 1 | content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1.js | - |
| LOW | LocalStorageShouldNotBeUsed | 15 | content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.jscontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a150.jscontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a121.js +12 more | - |
| LOW | postinstall file download | 54 | content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1255.jscontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1174.jscontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a110.js +51 more | - |
| LOW | NoUseWeakRandom | 37 | crm/assets/js/a4f80797-22d5-4297-917d-86ef37dbd5bb.cXrHUoy5.jsfunnil/assets/js/comp.DSSfKDyu.jsfunnil/assets/js/73dec7fc-166b-459f-b9ee-66ff960b47f5.x1a_bdTJ.js +34 more | - |
| LOW | NoUseEval | 1 | whatsapp/wpp/index.js | - |
| LOW | SQLInjection | 1 | fluxo/index.js | - |
| LOW | credential env files | 30 | whatsapp/wpp/index.jscontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1158.jscontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1105.js +27 more | - |
| LOW | postinstall persistence mechanism | 19 | crm/assets/js/bbe6027a-0ebf-4800-84e4-1154eb6d3526.7By4mzpU.jsfluxo/assets/js/cb085fba-558f-4c81-8b57-3764e3c1f4dd.Duus-Hzq.jsfluxo/assets/css/style.css +16 more | - |
| LOW | postinstall environment access | 111 | content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1187.jscrm/assets/js/index.BWQ95wG7.jscontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a179.js +108 more | - |
| LOW | postinstall network communication | 94 | content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1.jscontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1104.jscontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js +91 more | - |
| LOW | OriginsNotVerified | 5 | funnil/assets/js/7ee2c42a-b049-4676-8349-a3aa86ed295f.B8_nURbH.jsfluxo/index.jsfluxo/assets/js/cb085fba-558f-4c81-8b57-3764e3c1f4dd.Duus-Hzq.js +2 more | - |
| LOW | postinstall crypto operations | 38 | content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1.jscontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a156.jsfunnil/index.js +35 more | - |
| LOW | postinstall system command | 70 | content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.jsfunnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.jscrm/assets/js/bbe6027a-0ebf-4800-84e4-1154eb6d3526.7By4mzpU.js +67 more | - |
| LOW | postinstall obfuscation | 83 | crm/assets/js/bbe6027a-0ebf-4800-84e4-1154eb6d3526.7By4mzpU.jscontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a134.jscrm/assets/js/index.Tly2XSHS.js +80 more | - |
| LOW | postinstall registry modification | 8 | content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1170.jsfluxo/assets/js/f9d04165-6fb5-4342-a01d-9f195a27bc66.CX9ZOH_L.jscrm/assets/js/a4f80797-22d5-4297-917d-86ef37dbd5bb.cXrHUoy5.js +5 more | - |
| LOW | postinstall file manipulation | 160 | content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a137.jscrm/assets/js/index.Tly2XSHS.jscontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a138.js +157 more | - |
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
16 rules(727 hits)Requested Permissions
5 permissionsAI Security Report
AI Security Review
Evidence context: threat category unknown malware; evidence quality moderate.
WANQUEST describes itself as a CRM for WhatsApp Web, and its code includes network functions consistent with a connected web service. background.js:52:0, background.js:63:0, and background.js:137:0 each trigger NET-FETCH findings, so the background component can send or retrieve data. Several content assets also contain network libraries or calls, including NET-SOCKET_IO-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js-15, NET-JQUERY_AJAX-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a121.js-1, and NET-FETCH-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1230.js-1. Socket.IO, fetch, and jQuery AJAX are normal web-development tools, but these findings do not disclose the receiving domain, request content, or whether WhatsApp chat data is included.
Two files need closer inspection because their contents were difficult for the scanner to interpret. content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js:1:0 triggers OBFUSCATION-FUNCTION_INDIRECT, which identifies indirect function use. funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js:1:0 triggers OBFUSCATION-LARGE_BASE64, meaning it contains a large Base64-encoded value. Either pattern can be used in ordinary packed application code, yet they also prevent a direct reading of the executed logic from these findings alone. Runtime capture of requests from background.js:52:0 and decoded review of the Base64 value in funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js:1:0 would settle whether the code handles only the service’s own data.
There is no detection here for credential theft, browser-search replacement, proxy routing, or a malware family. The listed detections instead name network primitives in background.js:52:0 and bundled content files such as content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1146.js:64:0. The extension also declares no special permissions or host permissions. Those facts limit what can be concluded from the static scan, while the absence of disclosed network endpoints leaves the actual data flow unverified.
A skeptic could reasonably say that a WhatsApp CRM needs live updates and therefore Socket.IO in content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js:15:0 is expected. That explanation fits the product description and the NET-FETCH findings in background.js:52:0. It does not resolve the OBFUSCATION-LARGE_BASE64 finding in funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js:1:0, nor does it identify the destinations of the background requests. The available material supports inspection rather than a claim of harm.
Key Reasons
background.js:52:0,background.js:63:0, andbackground.js:137:0contain fetch activity without identified destinations.OBFUSCATION-LARGE_BASE64identifies an opaque encoded value infunnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js:1:0.OBFUSCATION-FUNCTION_INDIRECTis present incontent/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js:1:0.- The listed detections do not identify a malware family, credential target, search-hijack domain, or proxy endpoint.
- The extension declares no permissions or host permissions.
False Positive Considerations
- Socket.IO in
content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js:15:0fits a web CRM with live updates. - Fetch and jQuery AJAX findings in bundled content assets can result from ordinary application code.
- Indirect functions and Base64 content can occur in packed JavaScript assets.
Reviewed 2026-09-27; recommended action: runtime analysis; model confidence 72%.
Chrome version history
Risk trend by version
6 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
waSuper
[email protected]
Wa Elo IA
[email protected]
Whapro – Automação, CRM e Vendas no WhatsApp Web
[email protected]
Vende+
[email protected]
WaListall | O Melhor CRM para WhatsApp Web – Teste Grátis
[email protected]
InfiChat
[email protected]