Is Global Tech Mass Message Sender safe?

Medium risk

Global Tech Mass Message Sender reads your WhatsApp Web phone number and sends it to its own backend.

The extension reads the phone number of the logged-in WhatsApp Web account from the page's local storage. It sends that number, along with login history, subscription type and a count of messages sent, to the vendor's server at waglobaltech.globalcrm.in.

Strong link to a flagged operator: 1 of the 2 other listings from the same operator is rated high or critical for malicious behaviour. Flagged: Global Gym Software (high).

Global Gym Softwarev2.0.1Chrome Web Store
50Risk
Who publishes it

Global Gym Software - 2 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Global Gym Software
Declared legal entity
Global Gym Software
Website
waglobaltechsender.co.in/contact-us/

Same store account

2 other listings published from this account, 21k+ users between them. 2 of them carry a finding.

Global Gym Software20k+HighGlobal Gym Software SMS Sender1k+Medium

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

globalgymsoftware.com
Also called by 2 other listings, including أداة إرسال رسائل جماعية للواتساب

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp sender posts your own phone number to waglobaltech.globalcrm.in

Code analysis shows the extension reads the WhatsApp number you are logged in with and posts it to a vendor server when you use the popup login.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open the popup while WhatsApp Web is loaded and sign in with your number.

The extension did this

The extension reads your WhatsApp number and sends it to waglobaltech.globalcrm.in.

The code that does this

Number read from localStorage, then posted

Readable version

Handler returning the number to the popup

contentscript/content-v3-wa-send.js
getWpLoginNumber: function(e, t, n) {  var a;  0 < $("#pane-side").length ? n("" != (a = getMyWPPhoneNumber()) ? {    number_found: !0,    login_number: a,    whatsapp_web_open: !0  } : {    number_found: !1,    whatsapp_web_open: !0  }) : n({    number_found: !1,    whatsapp_web_open: !1  })}

Base URL

js/consts.js
'base_api_url' : 'https://waglobaltech.globalcrm.in/api/','auth_mobile_user_api_url' : 'auth_mobile_user.php','save_login_history_api_url' : 'save_login_history.php','auth_user_v2_api_url' : 'auth_v2_users.php',
Values sent to the vendor backend
  • WhatsApp number
    919812345678 (illustrative)

    The phone number of the account logged in to WhatsApp Web.

  • Login type
    Number

    Whether you signed in by number, email or free trial.

  • Message count
    128 (illustrative)

    A running total of messages sent through the extension.

Destination of the number
    • waglobaltech.globalcrm.in

    Vendor API receiving the number at auth_mobile_user.php, save_login_history.php and auth_v2_users.php.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 2.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on waglobaltech.globalcrm.in

    https://waglobaltech.globalcrm.in/api/*

  • See the address and title of every tab you have open

    tabs

  • Start, monitor and manage your downloads

    downloads

  • Show you desktop notifications

    notifications

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

Where it sends data

Destinations our analysis observed Global Tech Mass Message Sender contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • waglobaltech.globalcrm.in

    Global Tech Mass Message Sender sends data to waglobaltech.globalcrm.in. No other extension we have analysed sends data here.

Updated 15 October 2026lgeldnnflkoojefnopmfgjpkemlpjjkl