Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Adtrooper adblocker

CRITICAL RISKRemoved from Chrome Web Store

Adtrooper adblocker

ID: edikkkohcaaiffogdliacppnaekbdelm

Could be malicious

Extension Info & Metadata

Status

Removed

Version

0.15

Size

0.42 MB

Rating

5.0/5

Reviews

Users

133,448

Type

Extension

Updated

Nov 28, 2020

Publisher Contextual Analysis

Author: Suzanne KulasView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

133,448

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Adtrooper fights ads and protects your browsing experience

Adtrooper is an adblocker software. We fight on your side, preventing ad companies from hurting your browsing experience. Features: ✰ Automatically set up ad blocking rules by your geography ✰ Doesn’t slow down web pages loading speed ✰ No such thing as “Acceptable Ads” ✰ Whitelist - if you want to support a specific website or it doesn’t work

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High2

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.15 Code review	5

Extension Version	Code Review Findings
0.15	5

Files with findings

3 distinct paths — top paths by unique finding count:

background.js2
content.js2
popup.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Obfuscation	critical	background.js (line 199)	The GTM injection code uses multiple obfuscation layers: property accessor notation to call DOM methods (`doc[targetCmd]`), substring slicing to reconstruct the string `Element` from an unrelated variable name, and re…	0.15
2	Remote Code Loading	critical	background.js (line 192)	Heavily obfuscated IIFE injects a Google Tag Manager (GTM-5ZBNFJJ) script into the background page. The code disguises string literals via template-literal concatenation (e.g. `${"g"}tm.` + `start`), reconstructs `doc…	0.15
3	Code Injection	high	content.js (line 1108)	Uses `contentWindow.eval()` to inject executable JavaScript code into cross-origin iframe windows by serializing a function to string and evaluating it in the target frame's context. While nominally used for WebRTC bl…	0.15
4	Code Injection	high	content.js (line 1291)	Dynamically serializes a function to a string, wraps it in a Blob, creates an object URL, and injects it as a `<script>` tag into every page the extension's content script runs on (all http/https URLs). This pattern c…	0.15
5	Tracking	medium	popup.html (line 10)	The popup unconditionally loads a stylesheet from an external third-party CDN (cdnjs.cloudflare.com) at runtime. This creates a network request that can be used to track when users open the extension popup, leaking us…	0.15

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


rules.easyadblocker.com	/easylist.txt	https://rules.easyadblocker.com/easylist.txt
easylist.to	-	https://easylist.to/
rules.easyadblocker.com	/abpindo+easylist.txt	https://rules.easyadblocker.com/abpindo+easylist.txt
abpindo.blogspot.com	-	http://abpindo.blogspot.com/
rules.easyadblocker.com	/abpvn+easylist.txt	https://rules.easyadblocker.com/abpvn+easylist.txt
abpvn.com	-	http://abpvn.com/
rules.easyadblocker.com	/bulgarian_list+easylist.txt	https://rules.easyadblocker.com/bulgarian_list+easylist.txt
stanev.org	/abp/	http://stanev.org/abp/
rules.easyadblocker.com	/easylistchina+easylist.txt	https://rules.easyadblocker.com/easylistchina+easylist.txt
abpchina.org	/forum/	http://abpchina.org/forum/

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

çok iyi sadece bu bile iş görüyor

Caner Yalçın·2 Dec 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Adtrooper adblocker

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews