SelectorsHub Opens Remote-Controlled Ad Tabs Without Asking
SelectorsHub, a Chrome developer tool with about 400,000 users, fetches ad URLs from selectorshub.info and opens them in background tabs on install and update, with destinations the operator rotates server-side.
Overview
SelectorsHub is a popular Chrome extension for writing XPath and CSS selectors, with about 400,000 users. MalExt Sentry reported on 5 October 2026 that versions 5.8.3 to 5.8.5 run a forced-tab ad network: the extension asks its operator's server which ad URLs to show, then opens them in browser tabs. The servers decide the destinations, so they can change at any time without a store update. The ad and tracking endpoints are still present in the 5.8.6 build.
How it works
- On install and on every update, the extension fetches ad URLs from
selectorshub.info/nodeapp/api/link-adsand opens them in background tabs without asking the user. - In the side panel and DevTools views, it shows the ad URL behind a five-second countdown with the label "100% Safe, No Spam, No Malware", then opens it.
- Opens are reported to
selectorshub.info/nodeapp/api/link/track, and daily use toshub.selectorshub.info/user/counter. - A selector-fix feature calls
shubads.testcasehub.net, a second domain run by the same operator.
Observed destinations include blomehairdryers.com and tracked links to commercial testing products.
How to spot it
- New tabs opening right after SelectorsHub installs or updates.
- Requests from the extension to
selectorshub.info,shub.selectorshub.infoorshubads.testcasehub.net. - Teams that use SelectorsHub should weigh it against alternatives without an ad network, or block the endpoints above.
Affected extensions (1)
| Name | Store | ID | Malicious version | Archived |
|---|---|---|---|---|
| SelectorsHub View analysis | chrome | ndgimibanhlabgdgjcpbbndiehljcpfh | 5.8.3, 5.8.5, 5.8.6 | no |
Indicators of compromise (7)
| url | https://selectorshub.info/nodeapp/api/link-ads | Ad control endpoint: returns the URLs to open | |
| url | https://selectorshub.info/nodeapp/api/all-ads | Ad inventory endpoint | |
| url | https://selectorshub.info/nodeapp/api/link/track | Ad click and open tracking | |
| url | https://shub.selectorshub.info/user/counter | Daily usage counter | |
| url | https://shubads.testcasehub.net/gpt/fixpath | Selector-fix service on a second operator domain | |
| domain | blomehairdryers.com | Redirect destination observed in the ad rotation | |
| sha256 | 825cba49fe9a33aec29265633efa4200ff77ca745ed51b4a030b66863a755667 | full CRX, SelectorsHub 5.8.5 |