Bay Area Labs has identified Poper Blocker, a Chrome Web Store extension presenting as an ad blocker, as spyware that exfiltrates sensitive information — and one carrying every signal of legitimacy a user could check. It displays a "Featured" badge, its developer holds Google's "Established Publisher" status, it has a 4.8 out of 5 rating from more than 81,000 reviewers, and it claims over two million active users. The researchers say millions of people have installed infostealers disguised as ad-blocking extensions, in part because Google's own storefront provides the seals of approval those campaigns rely on. The practical point is that nothing visible to a shopper on the listing page distinguishes the extension from a legitimate one, so store vetting and enforcement — not user judgement — are the controls that matter here; the finding also sits on the same surface as earlier waves of fake AI-assistant extensions on the same store. Browser extensions should be treated as privileged software with access to every page a user visits, and reviewed accordingly rather than installed on the strength of a rating.

• Source article