Adblock for YouTube MAIN-world JS injection session cookie theft

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

This rule detects activity associated with malicious or intrusive browser extensions, specifically identifying network connections to a known malicious command-and-control (C2) endpoint, execution of specific scriptlet keywords related to MAIN-world injection in browser processes, and the presence of known 'BadBlocker' extension IDs on endpoints.