131 Chrome Extensions Hijack WhatsApp Web for Spam Campaign

First reported

20.10.2025 13:47

Last updated

1 unique sources, 1 articles

Summary

Hide ▲

A coordinated campaign used 131 rebranded clones of a WhatsApp Web automation extension for Google Chrome to spam Brazilian users. The extensions, collectively affecting 20,905 active users, inject code into WhatsApp Web to automate bulk messaging and bypass anti-spam controls. The operation has been ongoing for at least nine months, with recent updates observed in October 2025. The extensions are marketed as CRM tools for WhatsApp, allowing users to maximize sales through the web version. The extensions are published under various names and logos, but most are linked to 'WL Extensão' and 'WLExtensao,' believed to be part of a franchise model by DBX Tecnologia. The practice violates Google's Chrome Web Store policies.

Timeline

20.10.2025 13:47 1 articles · 5h ago

131 Chrome Extensions Hijack WhatsApp Web for Spam Campaign
A coordinated campaign using 131 rebranded clones of a WhatsApp Web automation extension for Google Chrome was discovered. The extensions, collectively affecting 20,905 active users, inject code into WhatsApp Web to automate bulk messaging and bypass anti-spam controls. The operation has been ongoing for at least nine months, with recent updates observed in October 2025. The extensions are marketed as CRM tools for WhatsApp and are linked to a franchise model by DBX Tecnologia, violating Google's Chrome Web Store policies.
Show sources

131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign — thehackernews.com — 20.10.2025 13:47
Open in new tab

Information Snippets

131 Chrome extensions were identified as part of a coordinated spam campaign targeting WhatsApp Web users in Brazil.
First reported: 20.10.2025 13:47

1 source, 1 article
Show sources
- 131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign — thehackernews.com — 20.10.2025 13:47
The extensions share the same codebase, design patterns, and infrastructure, indicating a coordinated effort.
First reported: 20.10.2025 13:47

1 source, 1 article
Show sources
- 131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign — thehackernews.com — 20.10.2025 13:47
The extensions collectively have about 20,905 active users.
First reported: 20.10.2025 13:47

1 source, 1 article
Show sources
- 131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign — thehackernews.com — 20.10.2025 13:47
The campaign has been active for at least nine months, with recent updates observed in October 2025.
First reported: 20.10.2025 13:47

1 source, 1 article
Show sources
- 131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign — thehackernews.com — 20.10.2025 13:47
The extensions inject code into WhatsApp Web to automate bulk messaging and bypass anti-spam controls.
First reported: 20.10.2025 13:47

1 source, 1 article
Show sources
- 131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign — thehackernews.com — 20.10.2025 13:47
The extensions are marketed as CRM tools for WhatsApp, allowing users to maximize sales through the web version.
First reported: 20.10.2025 13:47

1 source, 1 article
Show sources
- 131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign — thehackernews.com — 20.10.2025 13:47
Most extensions are published under 'WL Extensão' and 'WLExtensao,' believed to be part of a franchise model by DBX Tecnologia.
First reported: 20.10.2025 13:47

1 source, 1 article
Show sources
- 131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign — thehackernews.com — 20.10.2025 13:47
The practice violates Google's Chrome Web Store Spam and Abuse policy.
First reported: 20.10.2025 13:47

1 source, 1 article
Show sources
- 131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign — thehackernews.com — 20.10.2025 13:47