Flagged in the threat library: RedDirection

Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →

Also reported by koi.ai, spin.ai

Chrome Web Store

Adblock Unlimited - Adblocker

by [email protected] · 100.0K users · 4.0 rating
7a8fda02-10ce-5947-9d6f-8d6184833cca | v1.1.13
58/ 100
MEDIUM risk
-16 since v1.0.12
73 → 58 · false positives removed
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
1 months ago
Version
v1.1.13
Artifact
SHA256 9B3…F81
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

1000 detail rows

YARA Rule Matches

14 rules
SeverityRuleHitsFilesMetadata
LOWcredential env files 15
rulesets/scripting/specific/default.jsrulesets/scripting/specific/spa-0.jsrulesets/scripting/specific/annoyances-cookies.js +12 more
-
LOWpostinstall persistence mechanism 59
_metadata/generated_indexed_rulesets/_ruleset31rulesets/scripting/declarative/annoyances-cookies.jsrulesets/scripting/specific/default.js +56 more
-
LOWWarpStrings 7
rulesets/scripting/specific/default.js_metadata/generated_indexed_rulesets/_ruleset47rulesets/main/stevenblack-hosts.json +4 more
-
LOWcredential skype data 8
rulesets/scripting/specific/default.jsrulesets/main/default.jsonrulesets/scripting/specific/annoyances-overlays.js +5 more
-
LOWLocalStorageShouldNotBeUsed 3
scripts/yt_main.jsscripts/adblox/assistant.jsscripts/worker.js
-
LOWDebuggerStatementsShouldNotBeUsed 17
rulesets/main/annoyances-overlays.jsonrulesets/scripting/scriptlet/annoyances-overlays.no-setInterval-if.jsrulesets/scripting/procedural/annoyances-overlays.js +14 more
-
LOWpostinstall file download 473
rulesets/scripting/scriptlet/chn-0.abort-current-script.jsrulesets/scripting/scriptlet/spa-1.no-requestAnimationFrame-if.jsrulesets/scripting/scriptlet/tur-0.no-xhr-if.js +470 more
-
LOWSQLInjection 1
scripts/scripting/css-specific.js
-
LOWNoUseWeakRandom 2
scripts/scripting/css-procedural.jsscripts/worker.js
-
LOWpostinstall crypto operations 1
_metadata/generated_indexed_rulesets/_ruleset42
-
LOWpostinstall network communication 100
rulesets/scripting/scriptlet/annoyances-overlays.json-prune.jsrulesets/scripting/scriptlet/default.no-setInterval-if.jsrulesets/scripting/scriptlet/cze-0.abort-on-property-read.js +97 more
-
LOWpostinstall obfuscation 192
rulesets/scripting/scriptlet/cze-0.abort-current-script.jsrulesets/scripting/scriptlet/annoyances-overlays.abort-on-property-read.jsrulesets/scripting/scriptlet/annoyances-overlays.abort-on-property-write.js +189 more
-
LOWpostinstall registry modification 11
rulesets/scripting/specific/annoyances-cookies.jsrulesets/main/default.jsonrulesets/main/stevenblack-hosts.json +8 more
-
LOWpostinstall file manipulation 107
rulesets/scripting/scriptlet/tur-0.set-local-storage-item.jsrulesets/scripting/scriptlet/annoyances-overlays.abort-on-property-read.jsrulesets/scripting/scriptlet/annoyances-overlays.set-constant.js +104 more
-

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

35
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
1
Portfolio

13 evidence rows available.

Finding Categories

3
Network

YARA Rules Matched

14 rules(996 hits)
credential env files postinstall persistence mechanism WarpStrings credential skype data LocalStorageShouldNotBeUsed DebuggerStatementsShouldNotBeUsed postinstall file download SQLInjection NoUseWeakRandom postinstall crypto operations postinstall network communication postinstall obfuscation postinstall registry modification postinstall file manipulation

Requested Permissions

6 permissions
<all_urls>

Access and modify data on every website you visit

Dangerous
webRequest

Intercept, modify, and block all network requests

High
tabs
Medium
declarativeNetRequest
Low
storage
Low
scripting
Low

AI Security Report

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension 'Adblock Unlimited - Adblocker' is a Chrome extension with a user count of 100,000. The extension's description claims it is an ad block tool for popular websites. The findings from the evidence bundle show that the extension has a 'tabs' permission declared in its manifest.json file, which could be potentially sensitive. Additionally, there are four network findings, including 'NET-AXIOS-rulesets/scripting/declarative/annoyances-overlays.js-1', 'NET-FETCH-scripts/settings.js-1', 'NET-JQUERY_AJAX-rulesets/scripting/scriptlet/pol-0.no-setInterval-if.js-1', and 'NET-FETCH-scripts/worker.js-1', all of which are of medium severity. However, these network findings are likely related to the extension's ad blocking functionality and do not appear to be malicious. There are no malware signatures or obfuscation findings, which suggests that the extension is not malicious. One potential counterargument to this verdict is that the extension's developer is not a well-known company, which could raise concerns about the extension's trustworthiness. However, the extension's functionality and findings do not suggest any malicious behavior, and the developer's email address is provided, which suggests some level of accountability. Therefore, based on the evidence, it appears that the extension is likely a legitimate ad blocker and not malicious.

Key Reasons

  • No malware signatures or obfuscation findings
  • Network findings are likely related to ad blocking functionality
  • Developer's email address is provided

False Positive Considerations

  • IoC Extractor Garbage
  • YARA Code-Smell Rules

Reviewed 2026-05-23; recommended action: no action; model confidence 80%.

Chrome version history

Risk trend by version

3 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.

Selected
58
Change since first
-18
Change from previous
-16
Versions:
First analyzed version
1.0.11
Apr 30, 2026
Risk range
58 to 75
Across analyzed versions
Latest analyzed version
1.1.13
Jun 11, 2026
Selected version
medium
Version
v1.1.13
4 months ago
Risk score
58
Findings
2348
Change vs previous
-16

Pick any point on the chart to explore that version's code below.

About This Extension

Adblock Unlimited can help stop annoying online ads from bothering you, make web pages load faster, and even enhance your security. See how much faster websites open once unwanted ads no longer appear. Try Adblock for free right now to enjoy all these advantages. FEATURES: - Block pop ups, ads, and annoying banners (even remove video ads!) - Block third-party trackers and protect your privacy - Browse safely by blocking malicious ads with malware, scams, and cryptocurrency miners - Improve page load times and enjoy a faster Internet - Customize your experience with filters, whitelists, dark mode, and other colorful themes Key Benefits: 1. Block Ads Effectively Stop seeing all sorts of ads on the websites you visit and start enjoying the web more. 2. Browse the Web More Safely Protect your privacy and personal information by disrupting tracking systems and blocking sneaky scams or suspicious ads. 3. Open Websites Faster Preventing ads from showing up makes websites appear more quickly so you can get more done. 4. Trust Your Favorite Websites Put the websites that you want to support on an exception list so they can keep earning money by showing ads to you. Your suggestions can make Adblock Unlimited even better. Share your ideas through feedback on extension web store.

Frequently Asked Questions