BadBlocker Adblock for YouTube Extension Session Cookie Exfiltration via MAIN-World Injection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects behavior indicative of the 'Adblock for YouTube' browser extension (or associated malicious variants) fetching rule configuration files from 'api.adblock-for-youtube.com', followed by suspicious outbound network traffic to non-Google/YouTube domains. This pattern suggests the extension is performing unauthorized data exfiltration, such as harvesting session cookies or credentials via injected scripts.