google chrome web store to download the adblock extension

In September, researcher Ankit Anubhav discovered that attackers were spreading the Beta Bot Trojan via an Adobe lookalike domain called adoḅecom (note the “b”). His research focused on the use of Unicode characters to represent Cyrillic and Greek alphabets in order to mimic Latin characters and fool users into thinking they’ve landed on a legitimate domain. Chinese researcher Xudong Zheng privately reported the issue to Google in January. In April, Google updated to Chrome 58 which included a patch for the Punycode vulnerability that simplified phishing attacks using Unicode domains. “We need to stop Unicode until we can get a handle on the situation,” Swift on Security said. Update: TWO fake AdBlock Plus, including one with fake user numbers, have been added back to the Chrome extension store, in the same place. Swift on Security said the developer used Cyrillic Unicode characters in the extension name allowing the malicious plugins to again sidestep Google’s malware filters. On Wednesday, Swift on Security put out the word about two more phony AdBlock Plus extensions in the store, one falsely claiming more than 10 million downloads. “This app was able to slip through the cracks, but we’ve identified the reason and are addressing it.” “After reviewing the issue in more detail, we found that a number of other similar instances of this campaign were detected and that our systems had successfully prevented them from reaching users,” Google said.

Google posted an update to the Chromium forum on Monday. 22 and made good use of dozens of keywords to entice users to the landing page on the Chrome Web Store. The plugin had been available since at least Sept. Google allows 37,000 Chrome users to be tricked with a fake extension by fraudulent developer who clones popular name and spams keywords. The popular Swift on Security Twitter feed chronicled the mess starting Tuesday when the account said an extension posing as AdBlock Plus and downloaded already close to 38,000 times, was still available on the Chrome Web Store. The incident ramped up again one day later when the developers were able to get two other shady plugins past Google’s defenses before those were removed.

Google scrambled this week to remove a malicious Chrome extension from its store and users’ machines after a popular Twitter account disclosed the issue publicly.

Google chrome web store to download the adblock extension