Advisories
Chrome Extension 'Poper Blocker' Disguises Spyware, Exfiltrates User Data
A Chrome Web Store extension marketed as an ad‑blocker, 'Poper Blocker', has been identified as spyware that harvests and sends sensitive user data to remote servers. The app enjoys a 4.8‑star rating, 81,000 reviews, and a 'Featured' badge, misleading users into trusting it. Defenders should remove the extension, block its domains, and monitor for outbound data exfiltration.
What Happened
Bay Area Labs discovered that the Chrome extension "Poper Blocker", promoted as an ad‑blocker, is actually a spyware program. It is listed in the Chrome Web Store with a green "Featured" badge, an "Established Publisher" status, and a 4.8‑star rating from more than 81,000 users. The extension claims to serve over 2 million active users.
Impact
The malware collects a wide range of sensitive information—including browsing history, login credentials, and device identifiers—and exfiltrates it to remote servers. Because of the extension’s high rating and Google’s approval badges, many users have installed it without suspicion.
Bay Area Labs warned that the data exfiltration is ongoing and that the extension’s traffic is not encrypted.
What to Do
Defenders should immediately:
- Identify and remove the "Poper Blocker" extension from all Chrome installations.
- Block the extension’s download URL and any domains used for data exfiltration in firewalls and DNS filtering systems.
- Scan endpoints for other suspicious extensions and for evidence of credential theft.
- Educate users about the risks of installing extensions that claim high ratings but lack transparency.
Related articles
Malicious Ad‑Blocker Extension Disguised as CrashFix Leads to ModeloRAT Infection
A new campaign, CrashFix, distributes a fake ad‑blocker extension that intentionally crashes browsers before offering a bogus fix. The extension installs the ModeloRAT backdoor, targeting high‑value users. Defenders should block the extension, monitor for related process activity, and update endpoint detection rules.
Read briefing
BragJack: Malicious Extension Hijacks AI Browser Assistants
A proof‑of‑concept attack named BragJack demonstrates how a single malicious browser extension can hijack AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. The technique abuses browser‑level privileges, allowing the attacker to read data and act on the user’s behalf without interaction. Defenders should remove suspicious extensions, enforce strict extension policies, and keep browsers updated.
Read briefing
Malwarebytes Updates Browser Guard with Pre-Click Search Reputation and On-Page Scam Analysis
Malwarebytes has released new updates to its Browser Guard extension, introducing Search Reputation ratings for major search engines and Scam Guard Lite for on-page threat analysis in Google Chrome. These additions aim to assist users and defenders in identifying malicious links and fraudulent pages prior to interaction.
Read briefing
FortiPAM Chrome Extension Vulnerability Enables Remote Traffic Proxying (CWE-287)
Fortinet’s Privileged Access Agent Chrome Extension contains an improper authentication flaw (CWE‑287) that lets an unauthenticated attacker proxy a user’s browser traffic through malicious servers when the user visits a compromised site. The vulnerability scores 9.1 on CVSS v3 and affects all users of the extension. Immediate action is required: update or remove the extension, block outbound connections to untrusted proxies, and monitor for anomalous traffic.
Read briefing