BadBlocker Adblock for YouTube Extension Data Exfiltration via Unistream/scripletsRules

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects HTTPS POST requests to known attacker-controlled infrastructure associated with the BadBlocker campaign (e.g., Unistream SDK, adblock-for-youtube domains). These requests often originate from browser extensions via injected scripts, facilitating the potential exfiltration of sensitive browser session data or credentials.