Is MMZap safe?

Medium risk

MMZap sends WhatsApp Web account identifiers and incoming message content to GrowSoft and runs its API responses in the page.

On WhatsApp Web, the extension injects scripts that read the account identifier and details from incoming messages, including sender or receiver identifiers and message body. It posts those JSON payloads to api.growsoft.io/maturador_extensao/request, then relays response text back into WhatsApp Web as JavaScript.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

ferramentasmarketingv2.0.3Chrome Web Store
40Risk
Who publishes it

ferramentasmarketing - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ferramentasmarketing

Same store account

1 other listing published from this account, 248 users between them, none of them carrying a finding.

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.growsoft.io
Also called by 2 other listings, including Sender - Envio de Mensagens em Massa

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Where it sends data

Destinations our analysis observed MMZap contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.growsoft.io

    MMZap sends data to api.growsoft.io. No other extension we have analysed sends data here.

Updated 30 September 2026dbogohdpdjiogkibmneanejjcbcdplfd