Is Pro Sender - Free Bulk WhatsApp Sender safe?

Question

Accepted Answer

Pro Sender - Free Bulk WhatsApp Sender is high risk. When you open WhatsApp Web with this extension installed, it reads your own WhatsApp phone number out of the page and asks the browser for the Google account email tied to your Chrome profile, then sends both to the developer's server at averion.in as part of a 'plan lookup' request. This happens automatically on every visit, with no action on your part. During dynamic analysis a phone number that had been placed into WhatsApp Web's local storage appeared verbatim in a request to aws-api-fp.averion.in, confirming the number leaves the device; the email parameter is included whenever a Google email is available to the browser. On each WhatsApp Web visit the extension fetches a configuration file from the developer's server at aws-api-gc.averion.in and applies whatever it returns to its running code. The response can replace the Google Analytics credentials it reports to, swap out the CSS/DOM selectors it uses to read elements on the WhatsApp page, change the pricing shown to you, and set a runtime flag that re-injects its script into the page. Because the server controls these values, the extension's behavior on WhatsApp Web can change after install without a Chrome Web Store update. During dynamic analysis this config request fired automatically on the first navigation to WhatsApp Web, confirming the live server-controlled channel.

Is Pro Sender - Free Bulk WhatsApp Sender safe?

Findings