BadBlocker Adblock Extension Session Cookie Theft via MAIN World JS Execution

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects browser process command line arguments indicating the execution of malicious adblock extensions. The detection identifies these extensions by their known Chrome Extension IDs, observation of requests to specific command-and-control API endpoints, and attempts to execute JavaScript in the MAIN browser world to access sensitive session cookies via document.cookie, cookieStore.getAll, or chrome.cookies.getAll.