ADGUARD EXTENSION MALWARE CODE

Other extensions used the cookie stuffing technique, that is, after receiving a command from the command and control server, they discreetly installed special “partner” cookies on the victim’s machine. In the image loaded in this way, ads are hidden using steganography, and the extension eventually embeds ads in search results. This domain has nothing to do with Google, and the name is deliberately similar to confuse a potential observer”, – note the researchers. If it was Bing or Google search results, the malware downloaded an image from the domain.

“For example, some extensions checked which page they run on.

ADGUARD EXTENSION MALWARE CODE

In fact, 245 out of 295 extensions did not have any useful functionality for users and could only change the custom background for new tabs in Chrome.Īll these extensions did not become malicious immediately: only after receiving the appropriate command from a remote server, they downloaded malicious code from, and then quietly injected ads into Google and Bing search results. Were also discovered xtensions masked under weather widgets and utilities for creating screenshots. Most of the dangerous extensions masked themselves as ad blockers and were easily found by queries such as adblock, adguard, ublock, ad blocker, and so on.

These Chrome browser extensions injected ads into Google and Bing search results.

AdGuard analysts have identified 295 malicious extensions in the Chrome Web Store that have been installed over 80,000,000 times.

Adguard extension malware