WaSteal (wascript.com.br) White-Label WhatsApp Data Collection Network

Overview

One platform, dozens of faces. wascript.com.br runs a white-label WhatsApp Web CRM (internal name watidy) that ships as independent-looking Chrome extensions for Brazilian small-business sellers: WaSeller, WaSpeed, waTidy, WhaScale, Whapro, InterZap, G5 Chat and well over a hundred more. Every variant shares the same Vite bundle, the same backend family, and the same hardcoded platform key (ffce211a-7b07-4d91-ba5d-c40bb4034a83). Verified builds across four different brand names were 98–99% byte-identical down to the file hashes; only icons, the manifest and a per-brand label/config/utils.json (brand id, store ID, nameID, sigeID index) differ.

MalExt Sentry disclosed the network as WaSteal on 2026-05-13 (126 extensions, ~148k installs). Our independent pass over CVEQ scrape data on 2026-08-22 clusters 136 extensions with ~209,287 installs on the same infrastructure — including reseller publishers outside the original report's set (MiqueCRM PRO via [email protected], Extract Leads via [email protected]). All listings checked were still live at time of writing.

What it does behind the CRM features

The advertised functionality is real: tagging, quick replies, scheduled sends, funnels. The undisclosed layer:

• Voice-note interception. Every audio message sent through the extension is POSTed base64-encoded to backend-utils.wascript.com.br/api/audio/convert-ptt-base64 before it reaches WhatsApp. Framed as format conversion; effect is third-party custody of private audio.
• PII + advertising-cookie exfiltration. Once every 24h the content script bundles profile data (name, email, phone registration, device fingerprint, user agent) together with _fbc, _fbp, _ga, _ttclid, _ttp cross-site ad identifiers and POSTs it to a per-reseller webhook URL. The throttle lives under an obfuscated localStorage key so casual inspection sees nothing.
• Runtime code execution. Panel pixel configs fetch JavaScript from extractleads.com.br/teste/*.js and static-files.watidy.com.br/*.js at runtime - unreviewed, changeable server-side, per-resender templated. WaSeller additionally embeds a live GTM container (GTM-KMZ9CZK) giving its operator a permanent push-any-JS channel with no store update ever again.
• Full WhatsApp API bridge. A page-context IIFE bridges internal WhatsApp modules (Chat, Contact, Msg, Conn, ...) giving read/write access to contacts, conversations and message sending on the user's behalf.

Permissions stay minimal by design (tabs, storage, alarms, unlimitedStorage; host web.whatsapp.com only) - the egress rides fetch/XHR from content scripts, which keeps it under permission-based heuristics.

Attribution notes

Publishing identities are disposable: [email protected] holds most listings, but satellite publishers (different emails, different countries) ship the same codebase with the same key - a reseller network, not independent developers. sigeID brand indices up to 66 imply ~60+ issued brands. All analyzed variants reported synchronized version numbers (7.4.3.78 across supposedly unrelated products), a fingerprint usable for future tracking.

Detection lessons

This network hid in plain sight because publisher-cluster rules key on raw publisher strings (resellers invisible) and domain-cluster rules cap out before 100+ member networks, while IOC extraction from minified JS drowns real infrastructure in false positives. Cross-brand artifact identity (shared file hashes, shared secrets, synced versions) is the reliable signal.