Poper Blocker Chrome Extension Spyware: Big Star Labs' 'Featured' Ad Blocker Exfiltrates Browsing History, Screenshots, and AI Chatbot Conversations From Millions

Key facts

Detection coverage

As of 2026-09-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2739 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Poper Blocker Post-Install Dormancy Expiry & Obfuscated Numeric C2 Interpreter Activation

Correlates a prior Big Star Labs extension install-ping (T1176) with the first subsequent contact to the shared C2/telemetry domains (api2.poperblocker.com, api.taskapi.net) at least ~20 hours later — matching the reported 24-hour sandbox/reviewer-evasion dormancy — and flags numeric command-identifier query parameters characteristic of the extension's obfuscated, number-based C2 interpreter protocol.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1497.003, T1027, T1140, T1620, T1082, T1217, T1113, T1119, T1005
• Data sources: web_proxy, cef_proxy_logs (CommonSecurityLog), mde_devicenetworkevents, dns_query_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy sourcetype=web_proxy dest_domain IN ("api2.poperblocker.com","api.taskapi.net")
| rex field=url "[?&](?:cmd|c|op)=(?<c2_cmd_id>\d{1,4})"
| eval has_numeric_cmd=if(isnotnull(c2_cmd_id),1,0)
| stats min(_time) as first_c2_contact count as c2_events values(c2_cmd_id) as cmd_ids by src_ip user dest_domain has_numeric_cmd
| join type=left src_ip user
    [ search index=proxy sourcetype=web_proxy dest_domain="clients2.google.com" url="*service/update2/crx*id%3Dbkkbcggnhapdmkeljlodobbkopceiche*"
      | stats min(_time) as install_ping_time by src_ip user ]
| where isnotnull(install_ping_time)
| eval dormancy_hours=round((first_c2_contact-install_ping_time)/3600,1)
| where dormancy_hours >= 20
| table src_ip user dest_domain install_ping_time first_c2_contact dormancy_hours has_numeric_cmd cmd_ids c2_events

Microsoft KQL

let InstallPings = DeviceNetworkEvents
| where RemoteUrl has "clients2.google.com" and RemoteUrl has "bkkbcggnhapdmkeljlodobbkopceiche"
| summarize InstallPingTime=min(Timestamp) by DeviceName, InitiatingProcessAccountName;
CommonSecurityLog
| where TimeGenerated > ago(48h)
| where DestinationHostName in ("api2.poperblocker.com","api.taskapi.net")
| extend CmdParam = extract(@"[?&](?:cmd|c|op)=(\d{1,4})", 1, RequestURL)
| summarize FirstC2Contact=min(TimeGenerated), C2Events=count(), CmdIds=make_set(CmdParam) by SourceIP, SourceUserName, DestinationHostName
| join kind=inner (InstallPings) on $left.SourceUserName == $right.InitiatingProcessAccountName
| extend DormancyHours = datetime_diff('hour', FirstC2Contact, InstallPingTime)
| where DormancyHours >= 20
| project SourceIP, SourceUserName, DestinationHostName, InstallPingTime, FirstC2Contact, DormancyHours, CmdIds, C2Events

Sigma

title: Poper Blocker Obfuscated Numeric C2 Interpreter Command Polling
id: 91d4f2b8-6a1e-4c3d-8f0a-2b3c4d5e6f70
status: experimental
description: Detects outbound requests to Big Star Labs' shared telemetry/C2 domains (api2.poperblocker.com, api.taskapi.net) carrying a short numeric command-identifier query parameter, consistent with the extension's reported number-referenced (rather than name-referenced) obfuscated C2 protocol used to frustrate static analysis.
references:
  - https://www.darkreading.com/application-security/chrome-store-poper-blocker-spyware-downloaded-millions
author: Threadlinqs Team
date: 2026-09-28
tags:
  - attack.defense-evasion
  - attack.t1497.003
  - attack.t1027
  - attack.t1140
  - attack.t1620
  - attack.discovery
  - attack.t1082
  - attack.t1217
  - attack.collection
  - attack.t1113
  - attack.t1119
  - attack.t1005
  - attack.tool.poper_blocker
detection:
  selection_dest:
    c-uri|contains:
      - 'api2.poperblocker.com'
      - 'api.taskapi.net'
  selection_cmd:
    c-uri|re: '[?&](cmd|c|op)=\d{1,4}'
  condition: selection_dest and selection_cmd
falsepositives:
  - Unrelated third-party API traffic that happens to resolve to the same shared hosting infrastructure and use short numeric pagination/cursor parameters named cmd, c, or op
level: critical
logsource:
  category: proxy

Known false positives:

• High-frequency legitimate API clients using short numeric pagination/cursor query parameters against unrelated domains, if the domain filter is ever loosened beyond the two confirmed Big Star Labs C2 hosts
• The dormancy join produces false negatives (not positives) if the install-ping detection missed the initial installation event — it does not itself introduce extra positives

Tuning notes: Tune the dormancy threshold (currently >=20h) against your own observed install-to-first-egress baseline; update the numeric-command regex (cmd|c|op) if traffic analysis shows the interpreter has rotated its query-parameter name; extend the C2 domain list from IOC feeds if Big Star Labs stands up additional shared infrastructure.

• 🔒 Big Star Labs Spyware Extension Install — Chrome/Edge Update-Ping to Known Extension IDs · unlock with TL Creds
• 🔒 Poper Blocker Post-Install Dormancy Expiry & Obfuscated Numeric C2 Interpreter Activation · unlock with TL Creds
• 🔒 Poper Blocker AI-Chatbot Session Exfiltration to Big Star Labs S3 Staging Buckets · unlock with TL Creds
• 🔒 Big Star Labs Spyware Extension Install — Chrome/Edge Update-Ping to Known Extension IDs · unlock with TL Creds
• 🔒 Poper Blocker Post-Install Dormancy Expiry & Obfuscated Numeric C2 Interpreter Activation · unlock with TL Creds
• 🔒 Poper Blocker AI-Chatbot Session Exfiltration to Big Star Labs S3 Staging Buckets · unlock with TL Creds
• 🔒 Big Star Labs Spyware Extension Install — Chrome/Edge Update-Ping to Known Extension IDs · unlock with TL Creds
• 🔒 Poper Blocker AI-Chatbot Session Exfiltration to Big Star Labs S3 Staging Buckets · unlock with TL Creds

Indicators of compromise

As of 2026-09-28, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-2739.

Sample indicators (3 of 17)

• Domain: api[.]taskapi[.]net
• URL: hxxps://s3[.]amazonaws[.]com/hcluster4
• Domain: yourblocksite[.]com

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

Technical analysis

Bay Area Labs reported it to Google in May 2026; as of this report the extension remains live, and it is the third Chrome Web Store product from the same publisher, Big Star Labs, first identified as a spyware operator by AdGuard in 2018.

Poper Blocker, listed on the Chrome Web Store as "Pop up blocker for Chrome(TM) - Poper Blocker" (extension ID bkkbcggnhapdmkeljlodobbkopceiche), presents itself as a conventional ad- and popup-blocking utility. It carries Google's green "Featured" badge and its developer holds "Established Publisher" status, a designation Google awards for verified identity and a clean policy-compliance track record. Bay Area Labs' automated testing found the extension behaves very differently from its stated purpose: on every page load it transmits the complete, unabridged URL visited (not merely pages where a popup was blocked), and it is capable of taking screenshots of the desktop and scraping arbitrary page content. Most notably for 2026, Bay Area Labs found Poper Blocker records and exfiltrates users' Claude, ChatGPT, and Gemini chatbot sessions -- prompts, responses, conversation titles, model selection, and account/subscription details -- turning a browser utility into a channel for harvesting sensitive AI-assistant conversations that may contain proprietary code, credentials, health, financial, or legal information.

To evade both the Chrome Web Store's automated/manual review and independent researchers, the extension sits idle for 24 hours after installation before activating any of its data-collection logic, a classic sandbox/analysis-window evasion. It further keeps its malicious logic outside its primary, reviewable codebase: the shipped extension bundles a lightweight interpreter that fetches and executes instructions from a remote command-and-control server at runtime, referencing commands by number rather than name and encoding/obfuscating the payloads it exchanges, which frustrates static analysis of the extension as submitted to the store. The extension's privacy policy nominally denies sharing "Personal Information" but, deeper in the document, discloses sharing with undefined "Affiliated Companies" and "third-party service providers" -- the actual data-sale relationship Bay Area Labs flagged as materially misleading.

Bay Area Labs attributes Poper Blocker to Big Star Labs, a Delaware-registered developer that Dark Reading confirmed also publishes two other Chrome Web Store extensions still live and Featured as of this report: CrxMouse (Chrome extension ID jlgkpaicikihijadgifklkbpdajbkhjo) and Block Site (Chrome extension ID eiimnmioipafcokbfikbljfdeojpcgbh), together with Poper Blocker serving roughly four million active users. This is not Big Star Labs' first exposure: AdGuard publicly identified the company in July 2018 as operating seven browser extensions and mobile/iOS apps -- an earlier generation of the same Poper Blocker, Block Site, and CrxMouse products, plus Android apps (Speed BOOSTER, Battery Saver, Clean Droid) and an iOS app (AdblockPrime) -- with more than 11 million cumulative installs. AdGuard's investigation found the Android apps abused the OS Accessibility Service (the same permission class most banking trojans rely on) to read browser address-bar URLs, and that AdblockPrime installed an MDM profile on iOS granting traffic interception and device-wide data access. Despite that 2018 public disclosure, Big Star Labs' Chrome Web Store presence was never durably remediated, and the company has since added AI-chatbot-conversation theft to its collection scope. Bay Area Labs reported its 2026 findings to Google in May 2026; Google had not removed the extension or responded to Dark Reading's request for comment as of this report, and Poper Blocker remains installable with its "Featured" and "Established Publisher" badges intact.

The pattern -- an ad-blocking or utility extension covertly harvesting AI chatbot conversations -- is not unique to Big Star Labs: in January 2026, The Hacker News and other outlets reported a separate campaign ("Smart Adblocker" and "Adblock for Browser", ~900,000 combined installs, published under different developer accounts, exfiltrating to smartadblocker[.]com and abforbrowser[.]com) using the same technique of patching global fetch/XMLHttpRequest/WebSocket calls to intercept and buffer ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, and Meta AI conversations before exfiltration. That campaign is operationally and infrastructurally distinct from Big Star Labs/Poper Blocker (different store listings, different domains, different developer identity) but demonstrates AI-conversation theft has become a repeatable monetization technique for extensions distributed through official browser stores.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1119 Automated Collection

Stealth

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1497.003 Time Based Checks; T1620 Reflective Code Loading

Command and Control

T1071.001 Web Protocols

Discovery

T1082 System Information Discovery; T1217 Browser Information Discovery

Persistence

T1176 Software Extensions

Initial Access

T1195.002 Compromise Software Supply Chain

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583.001 Domains; T1608.001 Upload Malware

Remediation

Patches

• No vendor patch exists; as of this report Google has not removed Poper Blocker, CrxMouse, or Block Site from the Chrome Web Store despite the May 2026 disclosure

Immediate actions

• Uninstall Poper Blocker, CrxMouse, and Block Site (all platforms) from managed and BYOD browsers via MDM/enterprise browser management
• Block outbound traffic to api2.poperblocker.com, api.taskapi.net, yourblocksite.com, and ben.crxmouse.com at DNS/perimeter
• Treat any Claude, ChatGPT, or Gemini conversations conducted on an affected browser as potentially exposed; rotate credentials, API keys, or secrets pasted into those sessions
• Audit Chrome/Edge/Firefox extension inventories for extension IDs bkkbcggnhapdmkeljlodobbkopceiche, baplddocidbpmmneofgnhkjojmibmpck, jlgkpaicikihijadgifklkbpdajbkhjo, and eiimnmioipafcokbfikbljfdeojpcgbh

Workarounds

• Replace with a vetted, open-source ad-blocking extension (e.g., uBlock Origin) restricted to an enterprise extension allowlist

Longer-term hardening

• Enforce an enterprise browser-extension allowlist rather than trusting Chrome Web Store "Featured"/"Established Publisher" badges as a safety signal
• Deploy extension risk-scoring/DLP tooling that flags broad host-permission extensions egressing to non-vendor domains or fetching remotely-interpreted code
• Establish periodic re-review of previously-flagged extension publishers -- Big Star Labs' spyware was publicly documented in 2018 and persisted unremediated for eight years

Affected and fixed versions

• Big Star Labs — Poper Blocker (Chrome extension, ID bkkbcggnhapdmkeljlodobbkopceiche)
  Vulnerable versions: all versions live as of 2026-09
• Big Star Labs — Poper Blocker (Edge extension, ID baplddocidbpmmneofgnhkjojmibmpck)
  Vulnerable versions: all versions live as of 2026-09
• Big Star Labs — Poper Blocker (Firefox extension)
  Vulnerable versions: all versions live as of 2026-09
• Big Star Labs — Poper Blocker (Android app, com.poperblocker.android)
  Vulnerable versions: all versions live as of 2026-09
• Big Star Labs — CrxMouse (Chrome extension, ID jlgkpaicikihijadgifklkbpdajbkhjo)
  Vulnerable versions: all versions live as of 2026-09
• Big Star Labs — Block Site (Chrome extension, ID eiimnmioipafcokbfikbljfdeojpcgbh; Firefox; Android)
  Vulnerable versions: all versions live as of 2026-09

Timeline

• 2018-07-27 AdGuard publishes the first public report identifying Big Star Labs as operating seven spyware-laced browser extensions and mobile/iOS apps -- including earlier versions of Poper Blocker, CrxMouse, and Block Site -- with more than 11 million cumulative installs, citing Accessibility Service abuse on Android and MDM-profile abuse on iOS.
• 2026-01-01 In January 2026, The Hacker News reports a separate, unrelated campaign ("Smart Adblocker" and "Adblock for Browser") stealing ChatGPT and DeepSeek conversations from roughly 900,000 users, establishing AI-chatbot-conversation theft as a repeatable ad-blocker-disguised spyware technique ahead of the Poper Blocker findings.
• 2026-05-01 Bay Area Labs reports its Poper Blocker findings -- full browsing-history collection, screenshot/page-scrape capability, and Claude/ChatGPT/Gemini conversation exfiltration -- directly to Google (reported in May 2026).
• 2026-09-28 Dark Reading identifies two additional Big Star Labs extensions, CrxMouse and Block Site, still live and "Featured" on the Chrome Web Store, bringing the publisher's active install base across at least three extensions to roughly four million users.
• 2026-09-28 Dark Reading publishes Bay Area Labs' findings in detail, describing Poper Blocker's 24-hour post-install dormancy period, its C2-driven interpreter with obfuscated numeric commands, and its Claude/ChatGPT/Gemini conversation theft.
• 2026-09-28 As of this report, Google has taken no visible action on the May 2026 disclosure: Poper Blocker remains live on the Chrome Web Store carrying its "Featured" badge and the developer's "Established Publisher" status.

Sources cited

• "Big Star Labs" spyware campaign affects over 11,000,000 people adguard.com · Research · 2018-07-27
• PromptSnatcher Ad Blocker Extensions Steal AI Chats From ChatGPT, Claude, and Gemini cybersecuritynews.com · Research
• Pop up blocker for Chrome(TM) - Poper Blocker chromewebstore.google.com · Vendor report
• Poper Blocker: Popup & Ad Blocker for Chrome (chrome-stats analysis) chrome-stats.com · Research
• Chrome Store Hosts 'Poper Blocker' Spyware Downloaded by Millions Dark Reading · News · 2026-09-28
• Chrome Extensions, Android and iOS Apps Caught Collecting Browsing Data BleepingComputer · News
• Two Chrome Extensions Caught Stealing ChatGPT and DeepSeek Chats from 900,000 Users The Hacker News · News

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Previous and next in malware

• NeedyMantis: Storm-3069 Post-Compromise Modular Malware in Targeted Operations Previous report
• RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritization Next report