BadBlocker Malicious Extension Ecosystem - Known Extension IDs and Infrastructure

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

This rule monitors and alerts on network connections originating from hosts to known command-and-control (C2) or infrastructure domains associated with malicious browser extensions, specifically those identified in the BadBlocker campaign. These extensions often masquerade as legitimate ad-blocking tools to perform lifecycle beaconing or redirect users to promotional/malicious content.