Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →
Also reported by malext.io, reddit.com
MI CIERRO
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 5 days ago
- Version
- v7.4.3.87
- Artifact
- SHA256 3B0…224
- Source
- Findings (non-IoC)
Is MI CIERRO safe?
MI CIERRO describes itself as a WhatsApp Web CRM. It declares no special permissions and lists no host permissions. The extension still contains outbound activity, including NET-FETCH-background.js-52 in background.js:52:0, Socket.IO activity in content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js:15:0, and endpoints such as api.atlassian-us-gov-mod.com and api.stg.atlassian.com.
Those connections can fit a web service, yet the supplied material does not explain why Atlassian-style endpoints serve a WhatsApp CRM. OBFUSCATION-LARGE_BASE64-funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js-1 also marks a large encoded payload in the funnil asset tree. If that payload sends chat or session data, it would matter to users.
The scan also flags generated JavaScript and UI-like strings such as color.text.accent.orange, which fit bundled code and extractor noise. No malware signature is tied to a file. The open question is the purpose of the Atlassian-style requests and the Base64 asset, so runtime tracing is needed before the extension is cleared.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
16 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | ServerHostnameNotVerified | 1 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289.js | - |
| LOW | LocalStorageShouldNotBeUsed | 15 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28927.jsfluxo/assets/js/emoji-picker-react.esm.LrTXoimj.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289128.js +12 more | - |
| LOW | postinstall file download | 55 | crm/assets/js/5e35787c-36b2-4a56-8ea4-4e0a75aa6943.D2Np3EBj.jsfunnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.jsfunnil/assets/ttf/Segoeui.chunk.ttf +52 more | - |
| LOW | NoUseEval | 1 | whatsapp/wpp/index.js | - |
| LOW | NoUseWeakRandom | 38 | fluxo/assets/js/b89d7b82-41f7-4061-9bc0-ae95ae5cd0a2.BLiJgZ4E.jsfunnil/assets/js/comp.DyHpIB2X.jsfunnil/assets/js/cd52f586-58a7-445a-a045-5f4032b22b71.qLgWFQJ-.js +35 more | - |
| LOW | SQLInjection | 1 | fluxo/index.js | - |
| LOW | postinstall environment access | 111 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28911.jscrm/index.jsfluxo/assets/js/createAudio.CLFqrCFJ.js +108 more | - |
| LOW | postinstall network communication | 94 | whatsapp/wpp/index.jscrm/assets/js/createAudio.CX471qRG.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28925.js +91 more | - |
| LOW | OriginsNotVerified | 5 | fluxo/index.jsfunnil/assets/js/770d23cd-9021-4aef-887e-d47811b5c322.B8_nURbH.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2896.js +2 more | - |
| LOW | postinstall crypto operations | 44 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289200.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28944.jscrm/assets/js/modal.DGPvvr-c.js +41 more | - |
| LOW | postinstall system command | 77 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28925.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28927.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28971.js +74 more | - |
| LOW | postinstall obfuscation | 83 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289170.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28927.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289252.js +80 more | - |
| LOW | postinstall registry modification | 8 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289175.jsfunnil/assets/js/68038811-0075-484f-8b19-297df42f51e1.CVYXH02z.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js +5 more | - |
| LOW | postinstall file manipulation | 172 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289140.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28938.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289.js +169 more | - |
| LOW | credential env files | 30 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289240.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289106.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289183.js +27 more | - |
| LOW | postinstall persistence mechanism | 19 | content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d2894.jscontent/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.jsfunnil/assets/js/2e0cf7f6-e9bc-41e0-84b5-f570a0e461c8.B8VBrnTG.js +16 more | - |
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
16 rules(754 hits)Requested Permissions
5 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The code matches the stated WhatsApp CRM purpose in scope, with network activity concentrated in background.js and content scripts. The findings NET-FETCH-background.js-52, NET-FETCH-background.js-63, and NET-FETCH-background.js-137 show that the background process performs outbound fetch operations. The content layer also contains NET-SOCKET_IO-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js-15 and NET-JQUERY_AJAX-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a121.js-1, which are consistent with a CRM that needs live updates and server communication, although the supplied findings do not show what data each request sends.
The endpoint list adds an unresolved concern. It includes api.atlassian-us-gov-mod.com, api.stg.atlassian-us-gov-mod.com, and api.stg.atlassian.com, while the extension description identifies a WhatsApp Web CRM. The network finding NET-FETCH-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1132.js-1 records fetch behavior in the content layer, yet the supplied material does not link that finding to a specific endpoint. The Atlassian-style names require runtime tracing because their relationship to WhatsApp CRM features is not established here.
Two medium obfuscation findings also need context. OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js-1 identifies indirect function use in a content asset. OBFUSCATION-LARGE_BASE64-funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js-1 identifies a large Base64 payload in the funnil asset tree. These titles do not prove harmful behavior, yet the second path is outside the plainly named CRM files and deserves decoding and execution tracing.
The broader finding set has strong noise markers. The network titles use generated asset names such as content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1255.js, and the endpoint list contains UI property strings such as color.text.accent.orange and border.radius.circle. Those details fit bundled JavaScript and extractor errors, so the total finding volume does not establish malware. The supplied results also provide no malware-signature title attached to a file, which lowers support for a malicious verdict.
A skeptic could say the fetch, Socket.IO, jQuery AJAX, and Base64 findings are normal dependencies for a web CRM. That is a fair reading of NET-SOCKET_IO-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1146.js-64 and NET-JQUERY_AJAX-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a121.js-13. The unresolved Atlassian-style endpoints and the funnil Base64 asset still prevent a clean clearance. Runtime analysis should capture request destinations and payloads, decode the Base64 asset, and confirm whether WhatsApp message or session data leaves the browser.
Key Reasons
api.atlassian-us-gov-mod.comand related Atlassian-style endpoints are unrelated to the stated WhatsApp CRM purpose in the supplied material.OBFUSCATION-LARGE_BASE64-funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js-1identifies an encoded payload in a separate asset tree.NET-FETCH-background.js-52and the content-layer Socket.IO findings show outbound communication without request destinations or payloads.- No malware-signature finding is attached to a file, while generated asset paths and UI-like endpoints indicate substantial scanner noise.
False Positive Considerations
- Generated bundled asset paths such as
content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1255.jscan create repeated network findings. - UI-like endpoint strings such as
color.text.accent.orangeandborder.radius.circleare consistent with IoC extractor garbage. - The
NET-JQUERY_AJAXandNET-SOCKET_IOtitles can describe ordinary CRM dependencies without proving data theft. - The two obfuscation findings are medium severity and have no accompanying malware-signature title.
Reviewed 2026-09-29; recommended action: runtime analysis; model confidence 76%.
Chrome version history
Risk trend by version
19 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
waSuper
[email protected]
Wa Elo IA
[email protected]
Whapro – Automação, CRM e Vendas no WhatsApp Web
[email protected]
Vende+
[email protected]
WaListall | O Melhor CRM para WhatsApp Web – Teste Grátis
[email protected]
InfiChat
[email protected]