Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Adblock Youtube ©

CRITICAL RISKRemoved from Chrome Web Store

Adblock Youtube ©

ID: aebimoinbhgklbfelgdlgccckihfcglk

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.0.0

Size

0.08 MB

Rating

4.5/5

Reviews

Users

6,184

Type

Extension

Updated

Dec 26, 2022

Publisher Contextual Analysis

Trusted

Author: ADS GlobalView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

6,184

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Removes ads from Youtube ©.

Removes ads from Youtube ©. ✓ Permissions: like common ad-blocking extensions we do need default permissions on every website to remove ads or popups for example on embedded videos and Youtube itself. ⓘ About Adblock for Youtube © is a content filtering and ad blocking browser extension which blocks all ads on Youtube ©. It allows users to prevent page elements, such as advertisements, from being displayed. Banner, Ad-Clips or even preroll ads you usually see before the actual video on Youtube are blocked by this extension. Features: + blocks ads, banner and popups + blocking of ads on external sites which load Youtube + prevent preroll ads from loading on Youtube + you can also remove annotations from videos and musics (see options page). + loads videos and YouTube website faster. The technology is simply based on adblocking filterlists which blocks external ad urls on Youtube. We do not change anything on the website itself. Adblock for Youtube boosts the performance to load websites (without ads and tracking) It is free to download and use!

User Growth

Showing data from Dec 27, 2022 to Apr 04, 2023

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 61 ratings+15 (33%)

Average Rating

Current: 4.52 / 5.0+4.52

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High3

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0 Code review	7

Extension Version	Code Review Findings
1.0.0	7

Files with findings

2 distinct paths — top paths by unique finding count:

scripts/background.js6
scripts/Utils.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	scripts/background.js (line 53)	Despite the misleading name `updateYoutubeAdRegexes`, this function harvests every cookie (name and value) for each domain in the remotely-controlled `dataDomain` list using the `cookies` permission. It serializes the…	1.0.0
2	Data Exfiltration	critical	scripts/background.js (line 98)	Stolen cookies and an AES-encrypted blob of victim-account HTML/data are exfiltrated to attacker URLs via custom HTTP headers ('Cookies', 'Authorizations'), tagged with a per-victim UUID and the Chrome runtime ID. The…	1.0.0
3	Network Interception	critical	scripts/background.js (line 71)	The `dataUrl` array (delivered remotely) is a mini-DSL: each entry is a pipe-delimited script of step-codes ('tX', 'tA', 'bA', 'tI') with regex/marker arguments that tell the worker to fetch authenticated URLs (`crede…	1.0.0
4	Remote Code Loading	critical	scripts/background.js (line 343)	On startup the service worker downloads a plain-text payload from an attacker-controlled non-Google domain (truelovesm.net) and parses it (split on '\|\|\|') into `extensionName`, `dataDomain` (list of cookie target doma…	1.0.0
5	Data Exfiltration	high	scripts/background.js (line 235)	Even the legitimate-sounding 'fetch ad regex list' call leaks a sample of the user's harvested cookies in the request headers and pulls a regex list straight from the attacker-controlled `host` (the first entry of the…	1.0.0
6	Remote Code Loading	high	scripts/background.js (line 368)	Every 24 hours the service worker forces itself to reload, which re-runs the fetch to truelovesm.net and re-executes the cookie-harvest loop with the (potentially updated) remote configuration. The 'DAU' comment is mi…	1.0.0
7	Tracking	high	scripts/Utils.js (line 11)	Generates a stable per-install UUID, persists it in chrome.storage.local, and includes it as the 'UUID' header on every exfiltration request in background.js. This lets the operator track and correlate every victim ac…	1.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fonts.googleapis.com	/css	https://fonts.googleapis.com/css?family=Roboto:300,500
chrome.google.com	/webstore/detail/$%7Bchrome.runtime.id%7D/reviews%60	https://chrome.google.com/webstore/detail/${chrome.runtime.id}/reviews`
truelovesm.net	/AdblockYoutube.txt	https://truelovesm.net/AdblockYoutube.txt?t=
chrome.google.com	/webstore/detail/$%7Bchrome.runtime.id%7D%60;	https://chrome.google.com/webstore/detail/${chrome.runtime.id}`;
www.facebook.com	/sharer/sharer.php	https://www.facebook.com/sharer/sharer.php?u=${encodeURIComponent(
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Lo eh probado con otros dispositivos y funcionado muy bien.

Sergio Mendoza·4 Apr 2023

its a good but its somethimes not work

joel piard·3 Apr 2023

It really works! Goodbye annoying ads!

Jerome Puno·3 Apr 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Adblock Youtube ©

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews