5 Backdoored Ad Blockers Removed from Chrome Store
The malicious ad blockers were discovered by Andrey Meshkov, co-founder of Adguard, who detailed his findings in a blog post. While he noted that hackers have long created cloned versions of popular ad blockers, they have grown more sophisticated.
These criminals still use simple rip-offs of popular products, with a few lines of code added by the new authors. But instead of using similar names like Adguard Hardline or Adblock Plus Premium, they spam keywords into the extensions description, trying to move it to the top search results and increase the likelihood of getting a victim to download it.
Cloning real ad blockers and adding malicious features into them has become a popular tactic for cybercriminals. For example, in 2017, a researcher discovered a fake Adblock Plus Chrome extension that tricked 37,000 users into installing it.
Basically, this is a botnet composed of browsers infected with the fake adblock extensions. The browser will do whatever the command center server owner orders it to do.
The following five ad blockers were found to use this malicious approach:
1 AdRemover for Google Chrome™ (10M+ users)
2 uBlock Plus (8M+ users)
3 Adblock Pro (2M+ users)
4 HD for YouTube™ (400K+ users)
5 Webutation (30K+ users)
These findings were reported to Google on Tuesday. By Wednesday, all five fake ad blockers were removed.
To best protect yourself, look very closely at any extension before you install it. You should check who the author of the extension is, and avoid installation if you cannot confirm that they are trusted.