952255 - Malicious addon "YoutubeAdblocker" needs blocklisting

Status: RESOLVED INVALID

(Toolkit :: Blocklist Policy Requests, defect)

Description

[MarkH]

Hello,

The attached zip contains a sample of a malicious addon. It hijacks a victim's Facebook account and sends spam to their friends.

Thanks!
Facebook Security

MD5: fdca911143ed2232c322922d0ac7c064

Comment 1

[MarkH]

Attachment: malicious_addon_sample.zip

Password on the attachment is 'infected'.

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

The attached add-on seems to be incomplete, and it doesn't appear to do anything. Please reopen this bug if you can provide the full XPI.

Comment 3

[Kris Maglione [:kmag]]

This add-on is being distributed with randomized IDs, and is currently one of our top search hijackers. I'm not sure where it comes from, or what it does, but combined with the above abuse report, I think we should block by name ASAP.

Comment 4

[rctgamer3]

Found a new one. Jorge, current status?
[e-mail] youtubeadblocker 1.0

Comment 5

[rctgamer3]

[e-mail] youtubeadblocker 1.0

Comment 6

[Jorge Villalobos [:jorgev] (he/him)]

We can't do the name block due to bug 1111728 (or at least we should wait for longer so usage of Firefox 28 and earlier isn't a factor).

I blocked those two IDs: https://addons.mozilla.org/en-US/firefox/blocked/i854, but I'll keep this bug open.

Comment 7

[Jorge Villalobos [:jorgev] (he/him)]

Closing old blocklist requests that shouldn't be valid after the move to WebExtensions-only in Firefox 57. Please comment if you think this bug is still valid and should be reopened.