Is ZIZ WHATSAPP CRM ROJO - Your most powerful assistant for Marketing & Sales safe?

Medium risk

ZIZ WhatsApp CRM sends your CRM data and uploaded files to a third-party backend, crmwhatsappred.toolscrm.com.

On WhatsApp Web, the extension sends workflows, message templates, quick replies, kanban tabs and scheduled statuses, along with a unique ID, version and license key, to crmwhatsappred.toolscrm.com. Attachment uploads go to the same host under the user's WhatsApp ID. On install it also fetches rules from api.waworkflow.com and applies them as network rewrite rules.

ZIZ CRM EXTENCION WEB WHATSAPPv21Chrome Web Store
50Risk
Who publishes it

ziz - no other listings under this identity, 4 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ZIZ CRM EXTENCION WEB WHATSAPP
Declared legal entity
ziz

Shared hosts - 4 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.waworkflow.com
Also called by 5 other listings, including WAWF, Etivi+ CRM para WhatsApp™ WEB.
go.wawf.app
Also called by 5 other listings
st.waworkflow.com
Also called by 6 other listings, including WAWF, Etivi+ CRM para WhatsApp™ WEB.
wp.waworkflow.com
Also called by 6 other listings, including WAWF, Etivi+ CRM para WhatsApp™ WEB.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp Web CRM data and license key are sent to an unbranded reseller backend

Code analysis shows CRM templates, workflows and tabs are sent with a license key to crmwhatsappred.toolscrm.com.

The package also ships a premium unlock script.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You save a message template, quick reply, workflow or kanban tab in the CRM sidebar on WhatsApp Web.

The extension did this

The extension posts that record, plus a license key and device identifier, to crmwhatsappred.toolscrm.com.

The request goes to a host that is not named in the extension's host permissions.

The code that does this

Template save posts to the third-party host; the original vendor call is commented out

Readable version

Message listener (no origin check)

contentScript.bundle.js:60497
window.addEventListener("message", async (e) => {  e.unique_id = uid;  e.version = ver;  e.license_key = lic;  if ("SEND_ANALYTICS_EVENT" === e.data.type) {
Fields in each POST body
  • CRM record
    requestData: template name and message text

    The template, workflow, quick reply or tab content you created.

  • License key
    license_key: (value read from extension storage)

    Your extension license value, sent with every request.

  • Unique ID
    unique_id: (value read from extension storage)

    A per-install identifier tying requests together.

  • Version
    version: 21

    The extension version making the call.

The code that does this

Attachment uploads are keyed to your WhatsApp user id

Readable version

Premium unlock script shipped in the package

unlock-whatscrm.ps1:59
const d = {plan_type:"PREMIUM Plus",device_data:{skd_id:"$rnd1",skd_device_id:"$rnd2",skd_device_name:"User Device",skd_signature:""},validate:{day_remaining:999,end_date:"2099-12-31"},is_subscription:true,sub_key:"premium_unlimited"};
Destination
    • crmwhatsappred.toolscrm.com

    Receives CRM records, license key and attachments; no vendor branding found, not in manifest host permissions.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 21. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on waworkflow.com

    *://*.waworkflow.com/*

  • Read and change your data on whatsapp.com

    *://*.whatsapp.com/*

  • Read and change your data on whatsup.plus

    *://whatsup.plus/*

  • Read and change your data on whatsapp.net

    *://*.whatsapp.net/*

  • Read and change your data on 127.0.0.1

    *://127.0.0.1/*

  • Read and change your data on localhost

    *://localhost/*

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Show you desktop notifications

    notifications

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See, disable and uninstall your other extensions, including your security ones

    management

Where it sends data

Destinations our analysis observed ZIZ WHATSAPP CRM ROJO - Your most powerful assistant for Marketing & Sales contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.waworkflow.com

    ZIZ WHATSAPP CRM ROJO - Your most powerful assistant for Marketing & Sales sends data to api.waworkflow.com. No other extension we have analysed sends data here.

  • crmwhatsappred.toolscrm.com

    ZIZ WHATSAPP CRM ROJO - Your most powerful assistant for Marketing & Sales sends data to crmwhatsappred.toolscrm.com. No other extension we have analysed sends data here.

Updated 15 October 2026aijkhfklcpklholglhhlfaookaanjmkb