Chrome Virus Cleaner Speed Booster

AI Security Review

Evidence context: threat category data exfiltration; evidence quality moderate.

The extension 'Chrome Virus Cleaner Speed Booster' presents multiple high-confidence risk indicators that warrant escalation. The extension name follows a classic security tool disguise pattern—claiming to clean viruses and boost speed while the actual code contains suspicious network infrastructure.

The 61 IoC findings include domains that are NOT benign false positives. The XIOC-DOMAIN-آ.lc finding shows an internationalized domain using Arabic script characters, a common technique for obfuscating malicious infrastructure. XIOC-DOMAIN-ѐ.cy contains a Cyrillic character substitution. Additional findings like XIOC-DOMAIN-w.zw, XIOC-DOMAIN-t4.ge, XIOC-DOMAIN-mq.pk, and XIOC-DOMAIN-t.tf use obscure country-code TLDs (.zw for Zimbabwe, .ge for Georgia, .pk for Pakistan, .tf for Tokelau) with 2-letter subdomain patterns characteristic of either DGA-generated domains or data exfiltration endpoints. The XIOC-DOMAIN-gameograf.com finding references a gaming-related domain that does not match the extension's stated purpose of browser cleaning.

The developer attribution '[email protected]' is a generic Gmail address with no company or organization name, which is a red flag for extensions claiming security functionality. Legitimate security tools are published by identifiable companies with proper developer accounts. The user count of 76 is extremely low, suggesting this extension has not gained organic adoption.

The one false positive in this bundle is XIOC-IP-::7, which matches the documented IPv6 fragment pattern (::, ::b, 6::) from minified JavaScript that the XIOC extractor misidentifies as real IPs. However, this single FP does not explain the 11 suspicious domain findings that remain after filtering.

Counterargument consideration: A skeptic might argue that without malware signatures or obfuscation findings, this could be a legitimate extension with poor domain hygiene. However, this argument fails because: (1) the domain patterns (IDN characters, obscure TLDs, 2-letter subdomains) are not characteristic of legitimate services, (2) the security tool disguise is a documented malware delivery pattern, (3) anonymous developer attribution for security software is a known risk indicator, and (4) the 9 code-smell findings are low-severity and per the guidelines should not drive verdicts. The combination of these factors creates a coherent threat picture of potential data exfiltration or command-and-control infrastructure disguised as a browser utility.

Key Reasons

• Internationalized domain names with Arabic (آ.lc) and Cyrillic (ѐ.cy) characters indicate obfuscated infrastructure
• Obscure TLDs (.zw, .ge, .pk, .tf) with 2-letter subdomains suggest DGA or exfiltration endpoints
• Security tool disguise pattern with anonymous Gmail developer attribution
• No malware signatures present but domain infrastructure is highly suspicious
• Very low user count (76) suggests limited organic adoption

False Positive Considerations

• XIOC-IP-::7 IPv6 fragment pattern from minified JavaScript
• Code-smell findings (9 low-severity) that are documented noise per guidelines

Reviewed 2026-04-27; recommended action: escalate; model confidence 82%.