Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: AdBlock 360

CRITICAL RISKRemoved from Chrome Web Store

AdBlock 360

ID: ghfkgecdjkmgjkhbdpjdhimeleinmmkl

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

🇳🇱Dutch

🇺🇸English

🇫🇷French

🇩🇪German

🇮🇹Italian

🇪🇸Spanish

🇸🇪Swedish

Extension Info & Metadata

Status

Removed

Version

1.2.0

Size

0.02 MB

Rating

4.0/5

Reviews

121

Users

400,000

Type

Extension

Updated

Mar 4, 2025

Publisher Contextual Analysis

Author: https://adblock-360.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

400,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Blocks popups, ads, trackers from our block list

Extension features : 🔥 Eliminate annoying popups 🧹 Hide or remove bad ads 🤖 Block most social and privacy trackers 🥷 Not detected by anti-adblock scripts. We do not block all ads, we keep some search engine and display ads which are relevant. If you find that we should block an annoying and repetitive ad, please report and we will add it. Our privacy policy is available here : https://adblock-360.com/privacy.htm Its a long read, so we will make it easy : - We do not log any personal information with this extension. - The only thing we log is how many ads we help you block and its anonymous.

User Growth

Showing data from Apr 16, 2024 to Mar 31, 2025

Versions

-25%(-100,000 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 120 ratings-1 (-1%)

Average Rating

Current: 3.98 / 5.0+2.20

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High6

Medium4

Low0

Versions scanned

Showing 2 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.9 Code review	6
1.0.0.0 Code review	7

Extension Version	Code Review Findings
1.0.9	6
1.0.0.0	7

Files with findings

4 distinct paths — top paths by unique finding count:

background.js6
js/sw.js5
content.js1
js/cs.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 124)	The backgroundScript() function constructs a JavaScript string by concatenating values stored in chrome.storage.local (keyed by group prefix such as 'google', 'youtube', 'default') and then injects it into every visit…	1.0.0.0
2	Remote Code Loading	critical	js/sw.js (line 229)	The extension reads arbitrary JavaScript source from `chrome.storage.local` and injects it into the page's main world on matching domains. Because those storage values are populated from the vendor server elsewhere in…	1.0.9
3	Remote Code Loading	critical	background.js (line 76)	The extension fetches JSON from a remote C2 server (adblock-360.com/json-control.php) and blindly writes the entire parsed response into chrome.storage.local via `chrome.storage.local.set(json)` with no validation or …	1.0.0.0
4	Data Exfiltration	high	js/sw.js (line 169)	On every startup the extension serializes all synced storage keys into the uninstall URL query string. This is a covert exfiltration channel because the browser will send that full state to the remote server when the …	1.0.9
5	Network Interception	high	js/sw.js (line 137)	The extension downloads declarativeNetRequest rules from a remote endpoint and installs them dynamically, using all synced state as request parameters. That gives the operator server-side control over what traffic is …	1.0.9
6	Other	high	js/sw.js (line 39)	This code builds a request containing extension state, fetches JSON from `adblock-360.com`, and blindly applies server-supplied keys into extension storage. The server can therefore push arbitrary values and control f…	1.0.9
7	Privilege Escalation	high	background.js (line 94)	On install, storeShutdown() enumerates all open browser tabs and forcibly closes any tab pointing to Chrome Web Store or Microsoft Edge Add-ons extension detail pages. This is an anti-removal technique: by closing the…	1.0.0.0
8	Unauthorized Data Collection	high	background.js (line 61)	The control() function contacts the C2 server on every navigation event (via backgroundScript) and at startup/install. It exfiltrates a per-user UID, a truncated extension ID, the current version, a running count of b…	1.0.0.0
9	Unauthorized Data Collection	high	content.js (line 31)	The content script runs a DevTools detection loop on every HTTPS page every 500ms using window dimension heuristics. When DevTools is detected, it immediately sends a message to the background script (type: 'warning')…	1.0.0.0
10	Network Interception	medium	background.js (line 177)	The webRequest blocking listener fires on every URL matching the 13,000+ entry banlist and calls control() on each match — meaning a C2 beacon is triggered on every blocked request, not just on a timer. This dramatica…	1.0.0.0
11	Tracking	medium	js/cs.js (line 19)	The content script watches for common DevTools shortcuts like `F12` and `Ctrl+Shift+I` on every page and reports the current host back to the background worker. Monitoring analysis/debugging attempts across all sites …	1.0.9
12	Tracking	medium	background.js (line 54)	The extension registers a per-user uninstall callback URL that sends a unique user ID and the number of blocked ads to the C2 server when the extension is removed. This enables the operator to track individual user un…	1.0.0.0
13	Unauthorized Data Collection	medium	js/sw.js (line 207)	The background worker records per-site interaction counters such as Google-specific `g`/`gi`, a generic `w`, and ad-view counters, then triggers remote updates via `updateControl(1)`. This is telemetry collection tied…	1.0.9

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
${root_domain}	/adb360-mv3jsonlocal.php%60;	https://${ROOT_DOMAIN}/adb360-mv3jsonlocal.php`;
${root_domain}	/goodbye.php	https://${ROOT_DOMAIN}/goodbye.php?${searchParams.toString(

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Best adblock ever!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Leo·16 Feb 2025

Use this everyday. It helps a ton!

Maria Currie·8 Dec 2024

Unbelievable!! This is extraordinary ad blocker. It works flawlessly on all my favorite sites, providing a smooth browsing experience.

Vlasta Delong·5 Dec 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

AdBlock 360

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions13

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews