Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →
Adblock Unlimited - Adblocker
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 1 months ago
- Version
- v1.1.13
- Artifact
- SHA256 9B3…F81
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
14 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | credential env files | 15 | rulesets/scripting/specific/default.jsrulesets/scripting/specific/spa-0.jsrulesets/scripting/specific/annoyances-cookies.js +12 more | - |
| LOW | postinstall persistence mechanism | 59 | _metadata/generated_indexed_rulesets/_ruleset31rulesets/scripting/declarative/annoyances-cookies.jsrulesets/scripting/specific/default.js +56 more | - |
| LOW | WarpStrings | 7 | rulesets/scripting/specific/default.js_metadata/generated_indexed_rulesets/_ruleset47rulesets/main/stevenblack-hosts.json +4 more | - |
| LOW | credential skype data | 8 | rulesets/scripting/specific/default.jsrulesets/main/default.jsonrulesets/scripting/specific/annoyances-overlays.js +5 more | - |
| LOW | LocalStorageShouldNotBeUsed | 3 | scripts/yt_main.jsscripts/adblox/assistant.jsscripts/worker.js | - |
| LOW | DebuggerStatementsShouldNotBeUsed | 17 | rulesets/main/annoyances-overlays.jsonrulesets/scripting/scriptlet/annoyances-overlays.no-setInterval-if.jsrulesets/scripting/procedural/annoyances-overlays.js +14 more | - |
| LOW | postinstall file download | 473 | rulesets/scripting/scriptlet/chn-0.abort-current-script.jsrulesets/scripting/scriptlet/spa-1.no-requestAnimationFrame-if.jsrulesets/scripting/scriptlet/tur-0.no-xhr-if.js +470 more | - |
| LOW | SQLInjection | 1 | scripts/scripting/css-specific.js | - |
| LOW | NoUseWeakRandom | 2 | scripts/scripting/css-procedural.jsscripts/worker.js | - |
| LOW | postinstall crypto operations | 1 | _metadata/generated_indexed_rulesets/_ruleset42 | - |
| LOW | postinstall network communication | 100 | rulesets/scripting/scriptlet/annoyances-overlays.json-prune.jsrulesets/scripting/scriptlet/default.no-setInterval-if.jsrulesets/scripting/scriptlet/cze-0.abort-on-property-read.js +97 more | - |
| LOW | postinstall obfuscation | 192 | rulesets/scripting/scriptlet/cze-0.abort-current-script.jsrulesets/scripting/scriptlet/annoyances-overlays.abort-on-property-read.jsrulesets/scripting/scriptlet/annoyances-overlays.abort-on-property-write.js +189 more | - |
| LOW | postinstall registry modification | 11 | rulesets/scripting/specific/annoyances-cookies.jsrulesets/main/default.jsonrulesets/main/stevenblack-hosts.json +8 more | - |
| LOW | postinstall file manipulation | 107 | rulesets/scripting/scriptlet/tur-0.set-local-storage-item.jsrulesets/scripting/scriptlet/annoyances-overlays.abort-on-property-read.jsrulesets/scripting/scriptlet/annoyances-overlays.set-constant.js +104 more | - |
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
13 evidence rows available.
Finding Categories
YARA Rules Matched
14 rules(996 hits)Requested Permissions
6 permissionsAccess and modify data on every website you visit
Intercept, modify, and block all network requests
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The extension 'Adblock Unlimited - Adblocker' is a Chrome extension with a user count of 100,000. The extension's description claims it is an ad block tool for popular websites. The findings from the evidence bundle show that the extension has a 'tabs' permission declared in its manifest.json file, which could be potentially sensitive. Additionally, there are four network findings, including 'NET-AXIOS-rulesets/scripting/declarative/annoyances-overlays.js-1', 'NET-FETCH-scripts/settings.js-1', 'NET-JQUERY_AJAX-rulesets/scripting/scriptlet/pol-0.no-setInterval-if.js-1', and 'NET-FETCH-scripts/worker.js-1', all of which are of medium severity. However, these network findings are likely related to the extension's ad blocking functionality and do not appear to be malicious. There are no malware signatures or obfuscation findings, which suggests that the extension is not malicious. One potential counterargument to this verdict is that the extension's developer is not a well-known company, which could raise concerns about the extension's trustworthiness. However, the extension's functionality and findings do not suggest any malicious behavior, and the developer's email address is provided, which suggests some level of accountability. Therefore, based on the evidence, it appears that the extension is likely a legitimate ad blocker and not malicious.
Key Reasons
- No malware signatures or obfuscation findings
- Network findings are likely related to ad blocking functionality
- Developer's email address is provided
False Positive Considerations
- IoC Extractor Garbage
- YARA Code-Smell Rules
Reviewed 2026-05-23; recommended action: no action; model confidence 80%.
Chrome version history
Risk trend by version
3 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
种草星球-TikTok爆单神器,商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]
Open Headers
[email protected]
100xBot
[email protected]
Rook
[email protected]
LinkVault Professional
[email protected]