Is Pro Sender - Free Bulk WhatsApp Sender safe?

High risk

Pro Sender transmits your WhatsApp phone number and Google account email to its vendor backend on every WhatsApp Web visit.

Each time you open WhatsApp Web, the extension reads your phone number from localStorage and your signed-in Google email via the Chrome identity API, then sends both to aws-api-fp.averion.in. The server can return arbitrary HTML that is injected directly into the WhatsApp Web page, and your phone number is also included as a label in every Google Analytics event sent to the vendor's GA property, linking your identity to behavioral telemetry.

Ocube Itv1.3.4Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

WhatsApp number and Google email sent to vendor on every visit

On WhatsApp Web, this extension reads your WhatsApp number from the page and your Chrome profile's Google email, then sends both to averion.in as a 'plan lookup' on every visit.

A planted number reached aws-api-fp.averion.in verbatim.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open WhatsApp Web while the extension is installed.

The extension did this

The extension reads your WhatsApp phone number and your Chrome-profile Google email and sends both to the developer's server.

The lookup runs automatically as part of a 'fetch plan details' routine every time the page loads.

02EvidenceFIELD TABLE
What gets sent to aws-api-fp.averion.in
FieldValueWhy it matters
Your WhatsApp phone number
5559990001Your own number, taken from WhatsApp Web's stored session. It directly identifies you and your messaging account.
Your Google account email
jane.doe@gmail.comThe Google account email signed into your Chrome profile, via the browser identity API. Ties your WhatsApp number to your identity.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://aws-api-fp.averion.in/ps/fp?phone=5559990001&email=jane.doe@gmail.com
Returns the account's plan/subscription details as JSON. During dynamic analysis a phone number seeded into WhatsApp Web local storage appeared verbatim in the phone= parameter of this request to averion.in.
04EvidenceCODE COMPARE
The code that does this

Reading your number, then requesting your email and sending both

What it actually does
Resolved request URL
GET https://aws-api-fp.averion.in/ps/fp?phone=<your WhatsApp number>&email=<your Google email>
05EvidenceTHIRD PARTY LIST
Where the data ends up
  • aws-api-fp.averion.in

    Developer-operated backend (averion.in) that receives your WhatsApp phone number and Google account email on every WhatsApp Web visit.

06EvidenceARTIFACT
Check if you're affected

Watches outbound traffic / proxy logs for the plan-lookup request that carries your WhatsApp number and Google email to averion.in.

RequiresA traffic capture tool (mitmproxy/Charles/Fiddler) or proxy logsbash + GNU grep
detect-prosender-exfil.sh · sh
#!/usr/bin/env bash
# Run your browser through a logging proxy (e.g. mitmproxy) while visiting
# web.whatsapp.com, then grep the flow log for the leak.
#   mitmdump -w whatsapp.flows
# Then:
INPUT="${1:-whatsapp.flows}"
strings "$INPUT" | grep -E 'aws-api-fp\.averion\.in/ps/fp\?phone=' \
  && echo 'LEAK: WhatsApp number (and possibly Google email) sent to averion.in' \
  || echo 'No plan-lookup exfil request seen in this capture.'
How to run it
  1. 1
    Capture browser traffic to a flow/HAR file while opening WhatsApp Web.
  2. 2
    Run: ./detect-prosender-exfil.sh <capture-file>.
  3. 3
    Any matching line shows your phone (and email) in the query string sent to averion.in.
SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Vendor server can change the extension's keys and behavior at runtime

On each WhatsApp Web visit, the extension fetches a config file from aws-api-gc.averion.in and applies it live: GA credentials, DOM selectors, pricing shown, and a re-injection flag can all change post-install without a Store update.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open WhatsApp Web with the extension installed.

The extension did this

The extension downloads a config file from the developer's server and applies it to its running code.

The config can change analytics credentials, the DOM selectors used on WhatsApp Web, pricing, and a flag that re-injects the script.

02EvidenceFIELD TABLE
Runtime values the remote config can overwrite
FieldValueWhy it matters
Analytics credentials (GA_CONFIG)
{ MEASUREMENT_ID: "G-XXXXXXXX", API_SECRET: "..." }Replaces the Google Analytics measurement ID and API secret the extension reports to, redirecting where your telemetry is sent.
Page selectors
{ chat_list: "div[data-testid='chat-list']" }Swaps the CSS/DOM selectors the extension uses to find and read elements on the WhatsApp Web page.
Pricing (PRICING_DATA)
{ premium: { price: "$9.99" } }Overrides the pricing displayed to you inside the extension UI.
Runtime flags (RUNTIME_CONFIG)
{ reloadInject: true, useOldInjectMethod: false }Setting reloadInject=true makes the extension dispatch a PROS::init event to re-initialize / re-inject its script into the page.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://aws-api-gc.averion.in/ps/gc?operation=get-all-config-data
Returns JSON ({"data":[{name, data}, ...]}) that is mapped by name into GA_CONFIG, DOCUMENT_ELEMENT_SELECTORS, PRICING_DATA, RUNTIME_CONFIG and others. During dynamic analysis this request fired automatically on first navigation to web.whatsapp.com; the captured response body was empty, but the live server-controlled config channel and its handling were confirmed.
04EvidenceCODE COMPARE
The code that does this

Fetching the remote config and applying it to live variables

What it actually does
Resolved config request
GET https://aws-api-gc.averion.in/ps/gc?operation=get-all-config-data
// response.data[] keyed by name -> GA_CONFIG / DOCUMENT_ELEMENT_SELECTORS / PRICING_DATA / RUNTIME_CONFIG
05EvidenceTHIRD PARTY LIST
Source of the runtime configuration
  • aws-api-gc.averion.in

    Developer-operated config server. Returns JSON applied to the extension's live analytics credentials, DOM selectors, pricing, and script-injection flags on each WhatsApp Web visit.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Your WhatsApp number is attached to every Google Analytics event

Every button click on WhatsApp Web sends a GA event via the developer's own account.

The event 'label' is built from your WhatsApp number plus plan type, tying telemetry to your number.

A planted number appeared verbatim in GA labels.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click any button or take any tracked action in the extension on WhatsApp Web.

The extension did this

The extension sends a Google Analytics event whose 'label' field contains your WhatsApp phone number.

The label is built from your number plus plan type and is attached to every tracked event.

02EvidenceFIELD TABLE
What rides along in each analytics event
FieldValueWhy it matters
Your WhatsApp number (in 'label')
5559990001 ExpiredYour phone number is concatenated into the analytics label, tying every recorded action to you personally instead of an anonymous ID.
Your WhatsApp number (in 'track')
5559990001The number is also carried in a separate 'track' parameter on the event.
Plan type
FreeTrialYour subscription tier, used to segment you alongside the number.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-Z5RKTJRHLN&api_secret=<redacted>
Google Analytics Measurement Protocol ingest. During dynamic analysis the seeded number 5559990001 appeared in params.label ('5559990001 Expired', '5559990001 FreeTrial') and params.track ('5559990001'); pre-seed events showed label 'Expired' with no digits, isolating the phone-in-label behavior.
Headers
Content-Typetext/plain
Body
{
  "client_id": "a1b2c3d4-e5f6-7890-abcd-ef0123456789",
  "events": [
    {
      "name": "whatsapp_visit",
      "params": {
        "label": "5559990001 Expired",
        "track": "5559990001",
        "type": "event",
        "session_id": "1718457600000",
        "engagement_time_msec": "100"
      }
    }
  ]
}
04EvidenceCODE COMPARE
The code that does this

The phone number is built into the analytics label and posted to GA

What it actually does
Resolved analytics request
POST https://www.google-analytics.com/mp/collect?measurement_id=G-Z5RKTJRHLN&api_secret=<redacted>
{ "events": [ { "name": "whatsapp_visit", "params": { "label": "<your number> <plan>", "track": "<your number>" } } ] }
05EvidenceTHIRD PARTY LIST
Where the analytics data goes
  • www.google-analytics.com

    Google Analytics (GA4 Measurement Protocol), measurement ID G-Z5RKTJRHLN. Receives event payloads whose label and track fields contain your WhatsApp phone number.

Data recipients

aws-api-fp.averion.inaws-api-gc.averion.inwww.google-analytics.comsheetdb.io
Updated 17 September 2026nnaaobbghcgbefbkhinikgdolfkgnhfj