131 Chrome Extensions Found Abusing WhatsApp Web for Spam Automation in Massive Reseller Scheme

A new analysis from Socket has exposed a large-scale spamware operation abusing Google’s Chrome Web Store and WhatsApp Web, identifying 131 Chrome extensions that are rebrands of the same tool designed to automate unsolicited messaging campaigns under the banner of “marketing automation.” According to Socket’s investigation, the extensions inject malicious JavaScript into the WhatsApp Web interface to automate outreach and scheduling and to bypass WhatsApp anti-spam enforcement, with at least 20,905 active users across listings with visible counts.

The operation has been running for at least nine months, with rebrands and updates arriving in regular waves throughout 2025, as developers attempt to evade detection. The dominant publisher label was WL Extensão (or WLExtensao), appearing on 83 of the 131 listings, and the network is controlled by two developer accounts linked to DBX Tecnologia and Grupo OPT, effectively two arms of the same business under the same founder.

The report describes a franchise-like reseller model where white-label versions are sold to Brazilian small businesses, while Chrome Web Store and WhatsApp policies are routinely violated.