BadBlocker Adblock for YouTube Extension Contacting Unistream/Malware C2 Infrastructure

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•4

This rule detects network connections and DNS requests to specific domains associated with Unistream SDK and other known BadBlocker malware infrastructure, often linked to malicious browser extensions such as Adblock for YouTube and related variants.