The threat involves a network of 50 Chrome extensions distributed via the Chrome Web Store, all operating from a single codebase and backend infrastructure, including a shared Firebase project and a hardcoded API key. This setup enables persistent communication channels and advanced features such as voice transcription and operator-configurable webhooks. The extensions replace WhatsApp Web's CSP, potentially allowing them to bypass standard security restrictions. The presence of multiple, inconsistent privacy policies that fail to disclose all backend communications suggests a lack of transparency and potential privacy violations. The centralized backend and shared API key create a single point of failure or compromise affecting all extensions in the cluster.

Users of any of the 50 extensions are potentially exposed to privacy risks due to centralized data collection and backend control. The replacement of WhatsApp Web's CSP and persistent communication channels could allow the extensions to intercept or manipulate user interactions with WhatsApp Web. The inconsistent privacy policies indicate that users may not be fully informed about data collection or backend activities. The shared hardcoded API key and backend infrastructure mean that compromise of one component could impact all extensions, amplifying the risk. However, no known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory or the original report at https://malext.io/reports/WhatsCluster/ for current remediation guidance. Users should consider uninstalling these extensions due to the privacy and security concerns identified. Chrome Web Store administrators and security teams should review and potentially remove or block these extensions. Developers and security teams should monitor for updates or official fixes from the extension maintainers or platform providers. No official fix or patch information is currently available.