BAY Area Labs says a Chrome extension called Poper Blocker is spyware despite presenting itself as a legitimate ad blocker on Google’s Chrome Web Store. The extension reportedly has more than 2 million active users, a 4.8 out of 5 rating from over 81,000 reviewers, and Google’s “Featured” and “Established Publisher” badges.
Researchers say it records complete browsing URLs, takes screenshots, scrapes webpage data and captures interactions with Claude, ChatGPT and Gemini, including prompts, responses, conversation titles, models used and subscription tiers. It also identifies approximate locations and links activity across devices.
According to the researchers, the extension delays malicious activity for 24 hours after installation and uses an interpreter to download commands from a command-and-control server. Its payloads are encoded and obfuscated, commands are represented by numbers resolved through a server-controlled dictionary, and it checks whether it is running in a sandbox.
Bay Area Labs reported Poper Blocker to Google in May 2026, but said it saw no effective response; neither Google nor the developer, Big Star Labs, commented to Dark Reading by publication.
The report says two other Big Star Labs extensions, CrxMouse and BlockSite, remain available on the Chrome Web Store, together serving nearly four million users; BlockSite has also exceeded 10 million Google Play downloads. Bay Area Labs additionally found in automated testing that one in five ad blockers with more than 100,000 users exfiltrated browsing histories, although it had not manually verified every result.
Users and organisations should check for and remove the named extensions, while recognising that obfuscation may make data transfers difficult for standard monitoring tools to identify.