# Poper Blocker Chrome Extension Spyware: Big Star Labs' 'Featured' Ad Blocker Exfiltrates Browsing History, Screenshots, and AI Chatbot Conversations From Millions > The Chrome Web Store extension "Poper Blocker" (2M+ active users, 4.8-star rating, "Featured"/"Established Publisher" status) was found by Bay Area Labs to exfiltrate complete browsing history, page screenshots, scraped page content, and full Claude/ChatGPT/Gemini chatbot conversations. It idles for 24 hours post-install to evade Google reviewers and researchers, downloads and interprets obfuscated numeric commands from a command-and-control server, and discloses its data-sale practices only deep in its privacy policy. Bay Area Labs reported it to Google in May 2026; as of this report the extension remains live, and it is the third Chrome Web Store product from the same publisher, Big Star Labs, first identified as a spyware operator by AdGuard in 2018. - **Published:** 2026-09-28T00:00:00Z - **Last reviewed:** 2026-09-28T00:00:00Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2739 - **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-poper-blocker-chrome-spyware-tl-2026-2739.webp?v=f220bf1f (Threadlinqs threat intel: Poper Blocker Exfiltrates AI Chats: Detection & IOCs (TL-2026-2739) — High severity, 17 IOCs, 9 detection rules.) - **ID:** TL-2026-2739 - **Severity:** HIGH - **Category:** MALWARE - **Status:** ACTIVE - **Actor:** Big Star Labs - **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below) ## Description Poper Blocker, listed on the Chrome Web Store as "Pop up blocker for Chrome(TM) - Poper Blocker" (extension ID bkkbcggnhapdmkeljlodobbkopceiche), presents itself as a conventional ad- and popup-blocking utility. It carries Google's green "Featured" badge and its developer holds "Established Publisher" status, a designation Google awards for verified identity and a clean policy-compliance track record. Bay Area Labs' automated testing found the extension behaves very differently from its stated purpose: on every page load it transmits the complete, unabridged URL visited (not merely pages where a popup was blocked), and it is capable of taking screenshots of the desktop and scraping arbitrary page content. Most notably for 2026, Bay Area Labs found Poper Blocker records and exfiltrates users' Claude, ChatGPT, and Gemini chatbot sessions -- prompts, responses, conversation titles, model selection, and account/subscription details -- turning a browser utility into a channel for harvesting sensitive AI-assistant conversations that may contain proprietary code, credentials, health, financial, or legal information. To evade both the Chrome Web Store's automated/manual review and independent researchers, the extension sits idle for 24 hours after installation before activating any of its data-collection logic, a classic sandbox/analysis-window evasion. It further keeps its malicious logic outside its primary, reviewable codebase: the shipped extension bundles a lightweight interpreter that fetches and executes instructions from a remote command-and-control server at runtime, referencing commands by number rather than name and encoding/obfuscating the payloads it exchanges, which frustrates static analysis of the extension as submitted to the store. The extension's privacy policy nominally denies sharing "Personal Information" but, deeper in the document, discloses sharing with undefined "Affiliated Companies" and "third-party service providers" -- the actual data-sale relationship Bay Area Labs flagged as materially misleading. Bay Area Labs attributes Poper Blocker to Big Star Labs, a Delaware-registered developer that Dark Reading confirmed also publishes two other Chrome Web Store extensions still live and Featured as of this report: CrxMouse (Chrome extension ID jlgkpaicikihijadgifklkbpdajbkhjo) and Block Site (Chrome extension ID eiimnmioipafcokbfikbljfdeojpcgbh), together with Poper Blocker serving roughly four million active users. This is not Big Star Labs' first exposure: AdGuard publicly identified the company in July 2018 as operating seven browser extensions and mobile/iOS apps -- an earlier generation of the same Poper Blocker, Block Site, and CrxMouse products, plus Android apps (Speed BOOSTER, Battery Saver, Clean Droid) and an iOS app (AdblockPrime) -- with more than 11 million cumulative installs. AdGuard's investigation found the Android apps abused the OS Accessibility Service (the same permission class most banking trojans rely on) to read browser address-bar URLs, and that AdblockPrime installed an MDM profile on iOS granting traffic interception and device-wide data access. Despite that 2018 public disclosure, Big Star Labs' Chrome Web Store presence was never durably remediated, and the company has since added AI-chatbot-conversation theft to its collection scope. Bay Area Labs reported its 2026 findings to Google in May 2026; Google had not removed the extension or responded to Dark Reading's request for comment as of this report, and Poper Blocker remains installable with its "Featured" and "Established Publisher" badges intact. The pattern -- an ad-blocking or utility extension covertly harvesting AI chatbot conversations -- is not unique to Big Star Labs: in January 2026, The Hacker News and other outlets reported a separate campaign ("Smart Adblocker" and "Adblock for Browser", ~900,000 combined installs, published under different developer accounts, exfiltrating to smartadblocker[.]com and abforbrowser[.]com) using the same technique of patching global fetch/XMLHttpRequest/WebSocket calls to intercept and buffer ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, and Meta AI conversations before exfiltration. That campaign is operationally and infrastructurally distinct from Big Star Labs/Poper Blocker (different store listings, different domains, different developer identity) but demonstrates AI-conversation theft has become a repeatable monetization technique for extensions distributed through official browser stores. ## MITRE ATT&CK - T1195.002 Compromise Software Supply Chain - T1176 Software Extensions - T1497 Virtualization/Sandbox Evasion - T1497.003 Time Based Checks - T1027 Obfuscated Files or Information - T1140 Deobfuscate/Decode Files or Information - T1620 Reflective Code Loading - T1082 System Information Discovery - T1217 Browser Information Discovery - T1113 Screen Capture - T1119 Automated Collection - T1005 Data from Local System - T1071.001 Web Protocols - T1567 Exfiltration Over Web Service - T1583.001 Domains - T1608.001 Upload Malware ## Free detection (Splunk SPL, Microsoft KQL, Sigma) **Poper Blocker Post-Install Dormancy Expiry & Obfuscated Numeric C2 Interpreter Activation** (`TL-2026-2739-SPL-002`) Correlates a prior Big Star Labs extension install-ping (T1176) with the first subsequent contact to the shared C2/telemetry domains (api2.poperblocker.com, api.taskapi.net) at least ~20 hours later — matching the reported 24-hour sandbox/reviewer-evasion dormancy — and flags numeric command-identifier query parameters characteristic of the extension's obfuscated, number-based C2 interpreter protocol. - **Languages:** Splunk SPL, Microsoft KQL, Sigma - **ATT&CK:** T1497.003, T1027, T1140, T1620, T1082, T1217, T1113, T1119, T1005 - **Data sources:** web_proxy, cef_proxy_logs (CommonSecurityLog), mde_devicenetworkevents, dns_query_logs - **Severity:** critical - **Confidence:** high ### Splunk SPL ```spl index=proxy sourcetype=web_proxy dest_domain IN ("api2.poperblocker.com","api.taskapi.net") | rex field=url "[?&](?:cmd|c|op)=(?\d{1,4})" | eval has_numeric_cmd=if(isnotnull(c2_cmd_id),1,0) | stats min(_time) as first_c2_contact count as c2_events values(c2_cmd_id) as cmd_ids by src_ip user dest_domain has_numeric_cmd | join type=left src_ip user [ search index=proxy sourcetype=web_proxy dest_domain="clients2.google.com" url="*service/update2/crx*id%3Dbkkbcggnhapdmkeljlodobbkopceiche*" | stats min(_time) as install_ping_time by src_ip user ] | where isnotnull(install_ping_time) | eval dormancy_hours=round((first_c2_contact-install_ping_time)/3600,1) | where dormancy_hours >= 20 | table src_ip user dest_domain install_ping_time first_c2_contact dormancy_hours has_numeric_cmd cmd_ids c2_events ``` ### Microsoft KQL ```kql let InstallPings = DeviceNetworkEvents | where RemoteUrl has "clients2.google.com" and RemoteUrl has "bkkbcggnhapdmkeljlodobbkopceiche" | summarize InstallPingTime=min(Timestamp) by DeviceName, InitiatingProcessAccountName; CommonSecurityLog | where TimeGenerated > ago(48h) | where DestinationHostName in ("api2.poperblocker.com","api.taskapi.net") | extend CmdParam = extract(@"[?&](?:cmd|c|op)=(\d{1,4})", 1, RequestURL) | summarize FirstC2Contact=min(TimeGenerated), C2Events=count(), CmdIds=make_set(CmdParam) by SourceIP, SourceUserName, DestinationHostName | join kind=inner (InstallPings) on $left.SourceUserName == $right.InitiatingProcessAccountName | extend DormancyHours = datetime_diff('hour', FirstC2Contact, InstallPingTime) | where DormancyHours >= 20 | project SourceIP, SourceUserName, DestinationHostName, InstallPingTime, FirstC2Contact, DormancyHours, CmdIds, C2Events ``` ### Sigma ```yaml title: Poper Blocker Obfuscated Numeric C2 Interpreter Command Polling id: 91d4f2b8-6a1e-4c3d-8f0a-2b3c4d5e6f70 status: experimental description: Detects outbound requests to Big Star Labs' shared telemetry/C2 domains (api2.poperblocker.com, api.taskapi.net) carrying a short numeric command-identifier query parameter, consistent with the extension's reported number-referenced (rather than name-referenced) obfuscated C2 protocol used to frustrate static analysis. references: - https://www.darkreading.com/application-security/chrome-store-poper-blocker-spyware-downloaded-millions author: Threadlinqs Team date: 2026-09-28 tags: - attack.defense-evasion - attack.t1497.003 - attack.t1027 - attack.t1140 - attack.t1620 - attack.discovery - attack.t1082 - attack.t1217 - attack.collection - attack.t1113 - attack.t1119 - attack.t1005 - attack.tool.poper_blocker detection: selection_dest: c-uri|contains: - 'api2.poperblocker.com' - 'api.taskapi.net' selection_cmd: c-uri|re: '[?&](cmd|c|op)=\d{1,4}' condition: selection_dest and selection_cmd falsepositives: - Unrelated third-party API traffic that happens to resolve to the same shared hosting infrastructure and use short numeric pagination/cursor parameters named cmd, c, or op level: critical logsource: category: proxy ``` **Known false positives:** - High-frequency legitimate API clients using short numeric pagination/cursor query parameters against unrelated domains, if the domain filter is ever loosened beyond the two confirmed Big Star Labs C2 hosts - The dormancy join produces false negatives (not positives) if the install-ping detection missed the initial installation event — it does not itself introduce extra positives **Tuning notes:** Tune the dormancy threshold (currently >=20h) against your own observed install-to-first-egress baseline; update the numeric-command regex (cmd|c|op) if traffic analysis shows the interpreter has rotated its query-parameter name; extend the C2 domain list from IOC feeds if Big Star Labs stands up additional shared infrastructure. ### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds - Big Star Labs Spyware Extension Install — Chrome/Edge Update-Ping to Known Extension IDs (locked: unlock with TL Creds) - Poper Blocker Post-Install Dormancy Expiry & Obfuscated Numeric C2 Interpreter Activation (locked: unlock with TL Creds) - Poper Blocker AI-Chatbot Session Exfiltration to Big Star Labs S3 Staging Buckets (locked: unlock with TL Creds) - Big Star Labs Spyware Extension Install — Chrome/Edge Update-Ping to Known Extension IDs (locked: unlock with TL Creds) - Poper Blocker Post-Install Dormancy Expiry & Obfuscated Numeric C2 Interpreter Activation (locked: unlock with TL Creds) - Poper Blocker AI-Chatbot Session Exfiltration to Big Star Labs S3 Staging Buckets (locked: unlock with TL Creds) - Big Star Labs Spyware Extension Install — Chrome/Edge Update-Ping to Known Extension IDs (locked: unlock with TL Creds) - Poper Blocker AI-Chatbot Session Exfiltration to Big Star Labs S3 Staging Buckets (locked: unlock with TL Creds) Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup ## Sample indicators (3 of 17) Defanged, TLP:CLEAR. - Domain: `api[.]taskapi[.]net` - URL: `hxxps://s3[.]amazonaws[.]com/hcluster4` - Domain: `yourblocksite[.]com` Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds ## Sources - [Chrome Store Hosts 'Poper Blocker' Spyware Downloaded by Millions](https://www.darkreading.com/application-security/chrome-store-poper-blocker-spyware-downloaded-millions) - ["Big Star Labs" spyware campaign affects over 11,000,000 people](https://adguard.com/en/blog/big-star-labs-spyware.html) - [Chrome Extensions, Android and iOS Apps Caught Collecting Browsing Data](https://www.bleepingcomputer.com/news/security/chrome-extensions-android-and-ios-apps-caught-collecting-browsing-data/) - [Two Chrome Extensions Caught Stealing ChatGPT and DeepSeek Chats from 900,000 Users](https://thehackernews.com/2026/01/two-chrome-extensions-caught-stealing.html) - [PromptSnatcher Ad Blocker Extensions Steal AI Chats From ChatGPT, Claude, and Gemini](https://cybersecuritynews.com/promptsnatcher-ad-blocker-extensions-steal-ai-chats/) - [Pop up blocker for Chrome(TM) - Poper Blocker](https://chromewebstore.google.com/detail/pop-up-blocker-for-chrome/bkkbcggnhapdmkeljlodobbkopceiche) - [Poper Blocker: Popup & Ad Blocker for Chrome (chrome-stats analysis)](https://chrome-stats.com/d/bkkbcggnhapdmkeljlodobbkopceiche) ## Full data The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-2739