The Mystery of the google ads

Out of the blue I started seeing ads in my google search. They were especially prominent due to the fact they were white, and I use a black background. It was caused by a trojan running in my chrome extension, which I suspect was installed by a name-jacked NPM plugin.

Impact and blast radius

Still happened even when …

  • In private mode
  • Disabling plugins
  • Close and reboot chrome

Went away when …

  • Using edge
  • Using another user profile in chrome

Detection

Debugging

  • I inspected the page, and saw the ads were in an iframe, being loaded from bing.com
  • The iframe was from findsingl.com, but I could find no results for that.
  • I went to the network tab, and observed network requests
  • I enabled ‘path’,’host’ and ‘initiator’, to see where someone was doing an odd call
  • I saw a network request from a chrome extension (recall disabled), to reppoflag.net
  • Searching the web, I found reppoflag was a trojan, associated with ad blockers
  • The ‘initiator’ field allowed me to click and see which code was making the request
  • I saw a “GUID”, which I’m not sure how I determined was the extension

Mitigation

  • I uninstalled all plugins (though will likely re-install some of them)
  • Everything was good.
  • Now, I wonder if other things are compromised.

Root Causing and hypothesis

I’m not sure this happened, but my guess:

  • I had a common chrome extension installed (uBlock)
  • I installed and ran a brand jacked NPM package (e.g npx run browser-pack, instead of npx run web-browser-pack).
  • The package modified the extension on disk (I didn’t verify, just guessing :( )
  • When my web page ran, the malicious extension ran, and loaded ads.

More details from Microsoft: Adrozek is a malware family that adds browser extensions, tampers with browser DLLs, and injects unauthorized ads into search results to earn affiliate ad revenue.

While web searches mentioned ad blockers were compromised, there was no evidence that uBlock was.

I wondered if something edited the uBlock extension on disk. Turns out NPM packages get “brand jacked” — Sonatype found malicious NPM packages mimicking legitimate libraries (jdb, db-json) that install the njRAT trojan. Here’s a deep dive into how sophisticated the attack can be.