BadBlocker Adblock Extension Session Cookie Theft via MAIN World JS Injection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects malicious browser extension behavior where code injection into the MAIN world context is used to access browser session cookies or credential stores. This pattern is characteristic of BadBlocker and similar variants that use remotely-fetched scripts to perform session hijacking.