131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign

Cybersecurity researchers have uncovered a coordinated campaign that used 131 rebranded clones of a WhatsApp Web automation Chrome extension to spam Brazilian users at scale. The 131 spamware extensions share the same codebase, design patterns and infrastructure, and collectively have about 20,905 active users, with some extensions such as YouSeller, performancemais, Botflow and ZapVende displaying small user counts while others reach higher numbers.

The extensions inject code directly into the WhatsApp Web page to automate bulk outreach and scheduling, aiming to bypass WhatsApp’s anti-spam measures and rate limits. Behind the operation is a branding group around WL Extensão and its variant WLExtensao, with many clones published by DBX Tecnologia under a reseller white‑label model that purportedly offers recurring revenue from R$30,000 to R$84,000 after an initial investment of R$12,000.

The Chrome Web Store Spam and Abuse policy prohibits duplicate functionality across multiple extensions, and DBX Tecnologia has even produced YouTube videos about bypassing WhatsApp’s anti‑spam algorithms. The disclosure comes as Trend Micro, Sophos and Kaspersky highlighted a broader campaign targeting Brazilian users with a WhatsApp worm named SORVEPOTEL, used to distribute a banking trojan codenamed Maverick.