20+ Million Chrome users affected by Fake Ad-Blockers with Malicious Code

Ink · Apr 19, 2018

Adguard Blog: Over 20,000,000 of Chrome Users are Victims of Fake Ad Blockers

Given how popular ad blocking is, it is quite a lot. This also explains why "cloning" wide-spread ad blockers has become so popular among online crooks. Seven months ago big news broke: 37,000 users were tricked into installing a fake Adblock Plus extension.

What if I told you that thanks to poor Chrome's WebStore moderation the situation is much worse, and in reality over 20,000,000 users are affected and tricked into installing fake malicious ad blockers?

AdRemover's Summary
Now back to the normal language. Here is a list of what this fake ad blocker does.

It hides malicious code inside a well-known javascript library (jQuery).
This code sends back to their server information about some of the websites you visit.
It receives commands from the command center remote server. In order to avoid detection, these commands are hidden inside a harmless-looking image.
These commands are scripts which are then executed in the privileged context (extension's "background page") and can change your browser behavior in any way.

Basically, this is a botnet composed of browsers infected with the fake adblock extensions. The browser will do whatever the command center server owner orders it to do.

I have scanned other extensions on the WebStore and found four more using the very same approach. By the way, two of them are not fake ad blockers, and nothing pointed to them being malicious until I checked the code.
Here is the full list.