BadBlocker Adblock-for-YouTube Extension with <all_urls> host_permissions Detected

Ibrahim Saud@tektrix

•updated Jun 25, 2026•2•0•2

This rule detects activities associated with specific malicious browser extensions, often masquerading as ad blockers. It monitors for file and command-line references to the unique extension IDs associated with these malicious payloads and also alerts on DNS requests directed at C2 domains known to be used by these extensions.