BadBlocker Adblock for YouTube Extension Fetching Remote Scriptlet Rules from api.adblock-for-youtube.com

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•3

This rule detects potentially malicious browser activity by monitoring for Google Chrome outbound network connections to known command-and-control (C2) domains associated with malicious browser extensions (e.g., BadBlocker). It also flags the installation or loading of specific, known-malicious browser extension IDs on endpoints.