YesCaptcha Assistant All-URL Page Data Collection

Overview

YesCaptcha Assistant (v1.4.7) is a captcha-solving client that runs on all URLs. The Chrome Web Store listing shows 90,000 users. The extension installs a content script on every HTTP(S) page via "matches": ["http://*/*","https://*/*"] (manifest.json:30) and has host_permissions for <all_urls> (manifest.json:53). It detects reCAPTCHA, hCaptcha, and Turnstile widgets and forwards challenge data to the vendor's own API endpoints. This is the product's advertised function, but the broad permission set creates a risk-by-design channel: the publisher can read page content and capture screenshots on any site the user visits.

How it works

The content script runs in all frames and scans for supported captcha widgets. When it finds one, it packages the challenge and sends it to https://api.yescaptcha.com (config.js:3) or https://plugin-api.yescaptcha.com/ (content/captcha_manager.js:1). The background page can also call chrome.tabs.captureVisibleTab (background.js:1) to grab the current visible tab as an image. A fetch call uses credentials:"include" (background.js:1), so cookies for the API domain are sent with requests. The extension also special-cases authentication pages: location.href.includes("https://appleid.apple.com/widget/account/") (content/captcha_manager.js:1), meaning it injects into Apple ID sign-in and similar pages.

Payload

The extension does not use eval or new Function, does not read .ssh or .env files, and only requests storage, contextMenus, and alarms permissions (manifest.json:48). No credential or token stealing logic was found in the current build. The MalExt “suspicious” label likely refers to an older version. The main risk is data exfiltration: page content, widget data, and screenshots can be sent to vendor servers, and the vendor can change server-side behavior at any time.

Store status

As of analysis, the extension is listed in the Chrome Web Store under ID jiofmdifioeejeilfkpegipdjiopiekl. Users should treat it as a high-permission utility and consider removing it unless the captcha-solving service is essential. The vendor has not disclosed any breach or misuse; the verdict is based on permission scope and data flow, not observed malicious activity.