BadBlocker Adblock for YouTube Extension Session Cookie Theft via MAIN-World Injection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects outbound network connections from endpoint processes to domains associated with a malicious browser extension. The extension is known to fetch scriptlets that enable main-world JavaScript injection and potential credential theft (e.g., document.cookie).