20+ Million Chrome users affected by Fake Ad-Blockers with Malicious Code

Ink

Administrator
Thread author
Verified
Staff Member
Well-known
Jan 8, 2011
22,361
Adguard Blog: Over 20,000,000 of Chrome Users are Victims of Fake Ad Blockers
Given how popular ad blocking is, it is quite a lot. This also explains why "cloning" wide-spread ad blockers has become so popular among online crooks. Seven months ago big news broke: 37,000 users were tricked into installing a fake Adblock Plus extension.

What if I told you that thanks to poor Chrome's WebStore moderation the situation is much worse, and in reality over 20,000,000 users are affected and tricked into installing fake malicious ad blockers?

AdRemover's Summary
Now back to the normal language. Here is a list of what this fake ad blocker does.
  1. It hides malicious code inside a well-known javascript library (jQuery).
  2. This code sends back to their server information about some of the websites you visit.
  3. It receives commands from the command center remote server. In order to avoid detection, these commands are hidden inside a harmless-looking image.
  4. These commands are scripts which are then executed in the privileged context (extension's "background page") and can change your browser behavior in any way.
Basically, this is a botnet composed of browsers infected with the fake adblock extensions. The browser will do whatever the command center server owner orders it to do.

I have scanned other extensions on the WebStore and found four more using the very same approach. By the way, two of them are not fake ad blockers, and nothing pointed to them being malicious until I checked the code.
Here is the full list.
Update: UPD (18.04.2018, 13:17 GMT+3): All five are taken down.
 

mekelek

Level 28
Verified
Well-known
Feb 24, 2017
1,661
now those numbers are frightening, took so long to actually spot it is even more frightening.
 
  • Like
Reactions: ZeroDay

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top