949266 - Malicious addon "VideoDownloadConverter" needs blocklisting

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[MarkH]

Hello,

The attached zip contains a sample of a malicious addon. It hijacks a victim's Facebook account and sends spam to their friends.

Thanks!
Facebook Security

MD5: d669d910b7e9d8fb83cd0abda4c3f0d0

Comment 1

[MarkH]

Attachment: malicious_addon_sample.zip

Password on the attachment is 'infected'.

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

This add-on runs an EXE that is flagged by a few AV tools

https://www.virustotal.com/en/file/baf1160eedf7d64989c9fa6b0d59cbf70352e3cc49b3df76325e378d0c691cbb/analysis/

ID: 4zffxtbr-bs@VideoDownloadConverter_4z.com

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i507

Comment 4

[Mindspark]

Mindspark here.  We are the developers of the VideoDownloadConverter XPI being blocked.  We would like to state emphatically that our software does not hijack Facebook accounts nor does it send spam to their friends.  We can’t comment on what you might be seeing that would cause this conclusion to be drawn, but rest assured that we can and will resolve this to your satisfaction.    You can expect a direct email from us shortly with introductions to our people who can help resolve this.