Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Adskip PRO

CRITICAL RISKRemoved from Chrome Web Store

Adskip PRO

ID: ogiabfmoeeenbmlkbgfmindbacnfikdc

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

2.0.2

Size

0.01 MB

Rating

3.5/5

Reviews

Users

20,000

Type

Extension

Updated

Jun 27, 2024

Publisher Contextual Analysis

Trusted

Author: Adblock ProView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

22,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Adskip Pro auto skip ads on Youtube and blocks many ads.

- Auto skip ads on Youtube where possible (some ads in Youtube cannot be skipped) - Hide ads in Google (they are not blocked, just hidden) - Blocks a lot of ads and tracking including Facebook, Tiktok, Google analytics and more. (see the full list on https://skipadswizard.com/index.html) We do not block ALL ads, because we need to avoid anti-ad blocking script, like the one on Youtube. You can read our privacy policy here : https://skipadswizard.com/privacy.html In a few words, we only track how many ads you block to measure our improvement when we update our blocking script Still sceptic ? After installing, check our score on this Ad Block Tester : https://d3ward.github.io/toolz/adblock Spoiler alert... we get 97% !

User Growth

Showing data from Apr 20, 2024 to Oct 15, 2024

Versions

No change in user count

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 4 ratings

Average Rating

Current: 3.50 / 5.0-0.30

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High5

Medium1

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.0.2 Code review	9

Extension Version	Code Review Findings
2.0.2	9

Files with findings

2 distinct paths — top paths by unique finding count:

background.js8
script.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	background.js (line 84)	declarativeNetRequest dynamic rules are fetched verbatim from skipadswizard.com/aspcr.php and installed without validation. Because the extension has <all_urls> host access and declarativeNetRequestWithHostAccess, the…	2.0.2
2	Remote Code Loading	critical	background.js (line 146)	On every top-frame and selected iframe load, the background fetches a per-domain code string from chrome.storage.local (which is populated from a remote server, see aspjson.php) and injects it into the page's MAIN wor…	2.0.2
3	Remote Code Loading	critical	background.js (line 41)	The extension regularly polls https://skipadswizard.com/aspjson.php and writes any returned key/value pair directly into chrome.storage.sync or chrome.storage.local with no validation or allow-list. Combined with clos…	2.0.2
4	Code Injection	high	background.js (line 138)	The 'iframe' branch is gated by script.js to fire only on Yahoo and Bing search result pages, where it triggers fetchCode keyed by `iframe<tld>` and injects MAIN-world JS into search-result iframes. Targeting search e…	2.0.2
5	Data Exfiltration	high	background.js (line 113)	The uninstall URL serializes the entire chrome.storage.sync contents (including syncuid, ad counters gads/ytads/bads/yhads, devtools-open counters, etc.) into query parameters sent to skipadswizard.com when the user r…	2.0.2
6	Privilege Escalation	high	background.js (line 212)	The remote server can send {"reset": ...} to wipe chrome.storage.local (clearing all per-domain injected code) and force-reload every open tab in the user's browser. This gives the operator on-demand control to swap p…	2.0.2
7	Tracking	high	background.js (line 183)	Every time the user navigates to Google, YouTube, Bing search, or Yahoo search, a per-engine counter is incremented and then immediately reported back to the C2 via controlUpdate(1) -> sendUpdateRequest, attaching all…	2.0.2
8	Tracking	high	script.js (line 19)	The content script, injected at document_start into every frame on every site (<all_urls>, match_about_blank, all_frames), listens globally for DevTools-opening shortcuts (F12, Ctrl+Shift+I/J/C/U, Cmd+Alt+I/J/C/U) and…	2.0.2
9	Obfuscation	medium	background.js (line 226)	Counterpart of the script.js DevTools detector: classifies the host where DevTools was opened (google vs other), increments g/w/gi counters, and force-triggers a C2 sync when a remotely toggled flag (syncl) is set. Th…	2.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


${rootdomain}	/aspjson.php	https://${rootdomain}/aspjson.php?c=${type}&${searchParams}&${extinfo}`;
${rootdomain}	/aspcr.php	https://${rootdomain}/aspcr.php?${params}`;
${rootdomain}	/uninst.php	https://${rootdomain}/uninst.php?${searchParams}`
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.3 out of 5 · 6 most recent reviews

Text reviews

Positive

Negative

the beast

Jakob Johnson·12 Feb 2023

it works you shod get it

Jaiden Straem·15 Mar 2022

i barley get adds now

issac diaz·26 Feb 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Adskip PRO

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating