Brazilian Company Secretly Harvests WhatsApp Data Through Chrome Extensions

A Brazilian company operates 126 Chrome extensions under different names, collectively installed by 148,000 users, all sharing the same codebase and backend. These extensions secretly harvest WhatsApp user data—including names, emails, device IDs, and tracking cookies—and intercept voice messages before forwarding them. The extensions also execute remotely hosted JavaScript and include a live Google Tag Manager tag, allowing the operator to push new code without updates. None of the listings disclose these behaviors or include a privacy policy.