The Google Chrome extension "Internet Download Manager" that has been installed by more than 200,000 users is adware.
The "Internet Download Manager" has been in the Chrome Web Store since at least June 2019, according to early reviews posted by users.
Although the extension may install a well-known and legitimate download manager program, BleepingComputer observed unwanted behavior exhibited by the extension—such as opening links to spammy websites , changing the browser's default search engine, and further harassing the user with pop -ups asking them to download more "patches" and unwanted programs.
A concerned BleepingComputer reader contacted them after seeing a Chrome add-on "running malicious websites impersonating a well-known piece of software.".
And his concern seems justified. The “Internet Download Manager” browser extension, which has been installed by more than 200,000 users to date, doesn’t seem so innocent.
There is actually a legitimate Windows program called Internet Download Manager, published by the software company Tonec.
Tonec offers such extensions for Firefox and Chrome. However, the original Chrome extension provided by the company is called IDM Integration Module.
Furthermore, Tonec 's FAQ specifically warns: "Please note that all IDM extensions that can be found in the Google Store are fake and should not be used."
In contrast, the fake Chrome extension “Internet Download Manager” appears to be maintained by a website called “Puupnewsapp” that claims to “increase download speed by up to 500%,” making it a “super software” for downloading games, movies, music, and “large files in minutes.” It sounds promising.
The instructions provided by the fake extension are even more complicated—why do you need to download and install multiple programs after installing the extension?
Specifically, when installing "Internet Download Manager", users are now asked to install an executable file from the puupnewsapp website and additionally download a "Windows Patch" ZIP file :
hxxps://www.puupnewsapp[.]com/idman638build25.exe hxxps://www.puupnewsapp[.]com/windows.zip
The executable file "idman638build25.exe" appears to be a valid, signed version of the legitimate Tonec Internet Download Manager.
The "windows.zip" file analyzed by BleepingComputer contains 32-bit and 64-bit versions of NodeJS and executes JavaScript code to adjust Chrome and Firefox registry settings .
See also: How to block YouTube on Chromebook?
What also seemed strange was that installing the Internet Download Manager extension in a test environment changed the browser's default search engine to smartwebfinder[.]com.
Pop-ups urging the user to install more browser add-ons , such as for Firefox, were also frequently observed, as was the extension that launches third-party websites in the browser.
Fortunately, reviewers, some as far back as 2019, seem to have caught the awful behavior. Although many (possibly inauthentic) reviewers claim to have no problems with the extension.
BleepingComputer readers have previously reported problems with similar fake extensions they found in the Chrome Web Store .
The elements of the fake extension are as follows:
Extension ID: lcdlanlaneooailnebnhamiiieebikid .crx hash (SHA-256): b4b47730b62592c21368c2546e578342fff8383693e89211155c2d61d88058ba Web Store URL: hxxps://chrome.google[.]com/webstore/detail/internet-download-manager/lcdlanlaneooailnebnhamiiieebikid?hl=en
See also: ChromeOS 104 released with user interface updates
BleepingComputer has reached out to Tonec for comment, and they have also notified Google about the malicious Internet Download Manager extension prior to publication.
A quick search in the Chrome Web Store for “IDM”, “IDM integration add-ons”, or “Download Manager” will yield results containing extensions with hundreds of thousands of user and favorable reviews that may seem promising.
While not all of these extensions are harmful, users should be cautious when installing new Chrome extensions and verify that they are official versions published by reputable software vendors.
Source: bleepingcomputer.com
