Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Adkill

CRITICAL RISKRemoved from Chrome Web Store

Adkill

ID: fhjieeiddoiibfbdknfligkjlpihnmjc

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.11.1

Size

0.33 MB

Rating

0.0/5

Reviews

Users

271,895

Type

Extension

Updated

Nov 26, 2020

Publisher Contextual Analysis

Author: Casimir HarberView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

271,895

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Relentless protection from ads and unwanted content

Adkill is an ad-blocking software. It basically filters out ads from web pages. It blocks all kinds of ads e.g. banner ads, popups, tracking pixels. It’s called relentless because Adkill doesn’t apply any kind of “acceptable ads” policy. The extension just blocks every ad it could find. Adkill doesn’t have sophisticated options that require expert knowledge of adblocking techniques. All necessary filters are already set up and work by default.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium4

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.11.1 Code review	4
1.11.0 Code review	6

Extension Version	Code Review Findings
1.11.1	4
1.11.0	6

Files with findings

4 distinct paths — top paths by unique finding count:

background.js6
popup.html2
content.js1
subscriptions.xml1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	subscriptions.xml (line 3)	All 20+ filter list subscriptions (EasyList, EasyPrivacy, Fanboy Social, language-specific lists) are fetched exclusively from `https://rules.easyadblocker.com/` — a domain unrelated to the legitimate upstream publish…	1.11.0
2	Network Interception	critical	background.js (line 6)	The extension injects Content-Security-Policy headers into every page's HTTP responses using the `blocking` + `responseHeaders` webRequest listener. The CSP values come from filter rules downloaded from `rules.easyadb…	1.11.0
3	Remote Code Loading	critical	background.js (line 6)	This extension is a fork of Adblock Plus with all legitimate ABP infrastructure URLs silently replaced by third-party domain `rules.easyadblocker.com` and `cdn.easyadblocker.com`. The operator of these domains has ful…	1.11.0
4	Network Interception	high	background.js (line 6)	The extension intercepts ALL HTTP/HTTPS requests across all tabs using `webRequest.onBeforeRequest` with `blocking` permission. Blocking decisions are made against filter rules fetched from the attacker-controlled `ru…	1.11.0
5	Phishing	high	background.js (line 6)	The extension polls `https://cdn.easyadblocker.com/notification.json` for push notifications and when a user interacts with a notification button, it opens URLs from that server in new browser tabs. An attacker who co…	1.11.0
6	Remote Code Loading	high	background.js (line 265)	This code dynamically constructs and injects a Google Tag Manager script URL into the privileged background page, using split strings to obscure the destination. Loading remote tag-manager code inside an extension bac…	1.11.1
7	Code Injection	medium	content.js (line 1101)	The content script serializes a function and executes it with `contentWindow.eval()` inside page/iframe contexts. Running eval-based injections on every matched site is a high-risk code-injection pattern because it cr…	1.11.1
8	Tracking	medium	background.js (line 10220)	This logic evaluates server-supplied notifications against local profiling attributes such as extension version, browser/platform version, locale, and total blocked count. That is a targeted messaging/tracking mechani…	1.11.1
9	Tracking	medium	popup.html (line 1)	The extension popup loads multiple remote stylesheets/fonts from third-party domains, including one over plaintext HTTP. Opening the popup therefore leaks extension activity to external services and gives remote parti…	1.11.1
10	Unauthorized Data Collection	medium	popup.html (line 1)	The extension popup loads a stylesheet from `http://allfont.ru` over unencrypted HTTP — a Russian font hosting domain. Every time the popup opens, the browser sends a plaintext HTTP request (including the extension ID…	1.11.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


rules.easyadblocker.com	/easylist.txt	https://rules.easyadblocker.com/easylist.txt
easylist.to	-	https://easylist.to/
rules.easyadblocker.com	/abpindo+easylist.txt	https://rules.easyadblocker.com/abpindo+easylist.txt
abpindo.blogspot.com	-	http://abpindo.blogspot.com/
rules.easyadblocker.com	/abpvn+easylist.txt	https://rules.easyadblocker.com/abpvn+easylist.txt
abpvn.com	-	http://abpvn.com/
rules.easyadblocker.com	/bulgarian_list+easylist.txt	https://rules.easyadblocker.com/bulgarian_list+easylist.txt
stanev.org	/abp/	http://stanev.org/abp/
rules.easyadblocker.com	/easylistchina+easylist.txt	https://rules.easyadblocker.com/easylistchina+easylist.txt
abpchina.org	/forum/	http://abpchina.org/forum/

Showing 1 to 10 of 70 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Adkill

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating