Millions of Chrome users have unwittingly downloaded a sophisticated spyware app disguised as an ad-blocker, according to a recent discovery by Bay Area Labs. The malware, known as “Poper Blocker,” has been masquerading on the Chrome Web Store with a glowing 4.8-star rating and over 81,000 reviews, earning its developer a prestigious “Established Publisher” badge from Google. However, experts warn that this seemingly innocuous app is actually exfiltrating sensitive information from its users, including browser histories, screenshots, and AI chatbot interactions.
Poper Blocker’s data theft capabilities are facilitated by classic malware techniques such as code obfuscation and sandbox detection, making it difficult for security researchers to detect. The app records the full URL of every page visited, captures screenshots, and even scrapes data from those pages. It also tracks users’ AI chat histories, including granular details about conversation titles, models used, and subscription tiers. Furthermore, Poper Blocker identifies users’ approximate locations and assigns them cross-device IDs, allowing it to associate all data with the same individual across multiple devices.
One of the most alarming aspects of this discovery is that Poper Blocker has been allowed to remain on the Chrome Web Store despite being reported as malware by Bay Area Labs in May 2026. Google’s failure to take swift action raises questions about its review process and vetting procedures for third-party apps. When asked for comment, Google did not respond.
The developers of Poper Blocker appear to be following modern malware best practices by keeping their malicious functionality outside of the primary codebase. Instead, they ship an interpreter that downloads instructions from a command-and-control (C2) server. This tactic allows them to avoid detection by reviewers and researchers, as the malware lies dormant for 24 hours after installation before activating.
What’s even more concerning is that Poper Blocker is not an isolated incident. Bay Area Labs has identified two other popular apps from the same developer that have been flagged as spyware nearly a decade ago. This raises concerns about the security and integrity of the Chrome Web Store, which has become a go-to platform for users seeking ad-blocking solutions.
In light of this discovery, users are advised to exercise extreme caution when downloading third-party browser extensions. While Poper Blocker may have been masquerading as an ad-blocker, its true intentions are malicious. To protect yourself from similar threats, make sure to:
* Read reviews and ratings critically, looking for red flags such as suspiciously high ratings or poor user feedback.
* Research the developer and their reputation online before installing any app.
* Be wary of apps that claim to offer too-good-to-be-true features or benefits.
* Regularly review your installed extensions and remove any that you no longer use or trust.
By being vigilant and informed, users can avoid falling prey to sophisticated malware like Poper Blocker.
Source: Dark Reading — 2026-09-28