PeculiaritiesSteal cookies from every siteIntercept form submissionsLog keystrokesReplace clipboard contents (crypto addresses)Hijack sessions and tokensRead your browsing historyInject scripts into pagesShow phishing overlaysRead moreElementDescriptionAssetsBrowser sessions, cookies and tokens, passwords from forms, clipboard contents (especially crypto addresses), browsing historyVectorMalicious extension disguised as legitimate (VPN, adblock, password manager)DeliverySideload (developer mode/unpacked extension), fake CRX, "install our plugin" phishing, substitution of an already installed extensionC2api.telegram.org— real-time data download via Bot APIProject work:Launching the bot (malexgen bot)The malexgen command bot -t "<TELEGRAM_TOKEN>" -c "<CHAT_ID>"initializes the interactive interface. The bot runs in real time and dynamically generates a list of "legitimate" extensions. Each element includes a backstory (origin story), name, description, and icon, allowing the extension to pass visual verification in the Chrome Web Store.Extension generationWhen a legitimate legend and the selected payload are selected (from 8 possible options: Cookie Stealer, Form Grabber, Keylogger, Clipboard Hijacker, Session Hijacker, History Snooper, Script Injector, Phishing Overlay), the following occurs:Generate a full manifest (manifest.json) in Chrome WebExtensions format.Embedding malicious code (payload) into background.js, content.js, or popup.Automatic creation of .crx archive using tools (for example, crx-builder or similar libraries).Command-and-Control Channel (C2):All data stolen by the extension (cookies, tokens, screenshots, keyboard logs, etc.) is collected and sent to Telegram chat in JSON format, with the ability to enable/disable sessions via the bot. This ensures low latency and eliminates the need for a local UI.Implementation Features:Backstory translation – the extension receives a detailed description in the selected language, which imitates malicious applications in the Chrome Web Store.Payload versatility —each of the 8 critical vulnerability variants can be activated without recompilation.Cross-browser compatibility - compatible with Chrome, Edge, Opera.The MIT license and disclaimer clearly indicate the educational nature of the use.Real-time monitoring —notifications and data are sent directly to Telegram without additional servers.
VIP Forum — Lifetime Access🔥
Join Our VIP Group Get lifetime access for just $100 and unlock a growing collection of 50+ PC and Android RATs, along with regular updates and community support.
What You'll Get
💻 50+ PC & Android RATs 🔄 Regular updates & new releases🛠 Community support 📢 Latest announcements and updates ♾️ Lifetime VIP access 👥 Private members-only forum💎 Lifetime VIP — $100 One Time payment, Lifetime access.
👉 Join now and become a VIP member (https://payment.ratlab.forum/)