Am I Being Pwned?
Get started

Is Group Contact Extractor for WA safe?

Medium risk

Group Contact Extractor for WA reads the user's WhatsApp phone number and sends it to an Alibaba Cloud logging service.

When the extension loads on WhatsApp Web, it reads the user's phone number from localStorage and assigns a persistent UUID. This data, along with behavioral telemetry such as popup interactions and export counts, is transmitted to an Alibaba Cloud (Aliyun) logging endpoint on each session and user action.

hb623999v2.0.12Chrome Web Store
45Risk
Who publishes it

hb623999 - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
hb623999

Same store account

2 other listings published from this account, 1k+ users between them, none of them carrying a finding.

Extension Manager for Chrome™1k+Cleanwa privacy253Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp export activity and a persistent device ID sent to Alibaba Cloud

MediumunwantedCWE-359Dynamic sandbox

Group Contact Extractor for WA logs usage to Alibaba Cloud.

What actually happens

You did this

You open the extension popup while on WhatsApp Web.

Opening the popup is a normal step before extracting or exporting contacts.

The extension did this

The extension sends a behavioral event to an Alibaba Cloud logging endpoint.

The event carries a persistent device ID, the install timestamp, an export-count field, and your WhatsApp number if it was previously stored.

Captured request

POSThttps://extensionow-log.ap-southeast-1.log.aliyuncs.com/logstores/h-group/track?APIVersion=0.6.0

Captured during dynamic analysis: opening the popup produced this POST to the Alibaba Cloud (Aliyun) Simple Log Service endpoint, carrying a persistent uuid and install timestamp.

Body
{  "__logs__": [    {      "extensionName": "hGroup",      "version": "2.0.8",      "firstVersion": "2.0.8",      "platform": "extension",      "uuid": "ZNWCzpu1xgHh",      "installTimestamp": "1781526675615",      "event": "openPopup",      "eventDetail": "",      "phone": "",      "isBusiness": "n",      "email": "",      "exportNums": 0    }  ]}

Fields carried in each tracking event

  • Persistent device ID
    ZNWCzpu1xgHh

    A random ID generated once per install and reused on every event, letting the operator link all of an install's activity over time.

  • Your WhatsApp number
    447700900123

    Included only if your number was previously read into the extension's storage. Empty otherwise.

  • Install timestamp
    1781526675615

    When the extension was first installed, used as a stable per-install marker.

  • Export count
    342

    On export events, the number of contacts, chats, groups, or labels exported in that action.

  • Event name
    exportContact

    Which interaction occurred: openPopup, exportContact, exportChat, exportGroup, or exportLable.

  • Business flag
    n

    Whether the extension detected a WhatsApp Business account.

The code that does this

Popup reads stored number, then routes events through the background worker to Aliyun

Readable version

On popup open: read stored number + business flag, send openPopup event

popup.js
chrome.storage.local.get(["userNumber", "businessFlag"], (stored) => {  const eventObj = { event: "openPopup" };  const updateParams = {};  if (stored.userNumber)   updateParams.phone = stored.userNumber;  if (stored.businessFlag) updateParams.isBusiness = "y";  chrome.runtime.sendMessage({ action: "log", eventObj, updateParams });});

On export: send event tagged with the number of records exported

popup.js
this.downloadCSV("Contacts", this.contactsInfoTwoPop);chrome.runtime.sendMessage({  action: "log",  eventObj: { event: "exportContact", eventDetail: "csv", exportNums: this.contactsInfoTwoPop.length },  updateParams: {}});

Background worker merges fixed params (uuid, phone, installTimestamp) with each event and sends it

background.js
chrome.runtime.onMessage.addListener((msg) => {  if (msg.action !== "log") return;  // updateParams (e.g. phone) become sticky fixed params  if (Object.keys(msg.updateParams).length) Object.assign(fixedParams, msg.updateParams);  if (Object.keys(msg.eventObj).length)    tracker.sendEvent({ ...fixedParams, ...msg.eventObj });});

Transport: sendBeacon to the Aliyun log endpoint, fetch POST as fallback

background.js
function sendBeacon(url, body) {  return !!(navigator && navigator.sendBeacon) && navigator.sendBeacon(url + "?APIVersion=0.6.0", body);}function sendFetch(url, body) {  fetch(url + "?APIVersion=0.6.0", { method: "POST", body }).catch(() => {});}

Where the telemetry is sent

    • extensionow-log.ap-southeast-1.log.aliyuncs.com

    Alibaba Cloud (Aliyun) Log Service, Singapore region. Receives behavioral events, the device ID, install time, export counts, and the WhatsApp number when present.

Where it sends data

Destinations our analysis observed Group Contact Extractor for WA contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • extensionow-log.ap-southeast-1.log.aliyuncs.com

    Group Contact Extractor for WA sends data to extensionow-log.ap-southeast-1.log.aliyuncs.com. One other extension we have analyzed sends data here.

Updated 30 September 2026hboaocjifmkibpeajkgaliiaaiodikon