BadBlocker Adblock for YouTube Extension Session Cookie Exfiltration via MAIN-World Script

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects outbound network traffic from browser processes to known BadBlocker extension command-and-control infrastructure (api.adblock-for-youtube.com or get.adblock-for-youtube.com), followed by subsequent outbound HTTPS connections to arbitrary external domains. This sequence is indicative of malicious browser extension activity involving the exfiltration of session cookies or authentication tokens from the victim's browser.