Security researcher Bryan Campbell has discovered a malicious MinerBlock extension for Chrome that is masquerading as a legitimate one. The legitimate MinerBlock extension is used to block websites that mine for cryptocurrency via the browser, while the newly discovered version forces Chrome to repeatedly play videos in the background without you knowing.
Their Chrome Web Store pages are different, with the fake one containing Russian text and a different developer name. The developer for the legitimate MinerBlock is from “CryptoMineDev,” while the malicious one is listed as “egopastor2016.” As for the extensions themselves, aside from the logo and version number, both look the same and have the same menu of options.
The big change is in their functionality. While the original MinerBlock was designed to block access to cryptomining websites, the malicious version is used to continuously play videos in the background.
It is not yet known why the extension constantly plays videos in the background, but it could be used for click fraud on various ads or to artificially increase their views. When launched, the malicious extension will connect to the egopastor.biz website and retrieve a set of “tasks”. These tasks will determine which options the extension will use and the URLs it should connect to. The extension will start connecting to the specified URL, which will cause videos from various Russian sites to play. When a video is playing, this will cause CPU usage to reach 100% and then drop back to 0% when the video ends.
For those who have this version installed, you can easily remove the extension by right-clicking on the icon and selecting remove extension.
