A Chrome extension marketed as improving Amazon shopping is exposed as a malicious tool that hijacks creator commissions by automatically injecting the developer’s affiliate tag (10xprofit-20) into every Amazon product link and replacing existing affiliate codes from content creators, despite also advertising ad blocking. The reveal notes that while the extension blocks ads, its primary hidden function is affiliate hijacking, enabling the developer to receive the full commission.
By using a MutationObserver to watch the user’s browsing in real time, the extension maintains control over affiliate tags even as Amazon loads new products via infinite scroll or AJAX requests. A misleading disclosure claimed commissions are earned when a coupon code or deal is revealed, which Socket’s Threat Research Team says is false, with the report describing a mismatch between disclosure and implementation.
The analysis also states the code violates Google’s policies by providing no user benefit for the injection and notes Chrome Web Store policies banning such behaviour; the extension remained available in the store at the time of writing. According to Socket’s Threat Research Team, users should uninstall the extension to stop unknowingly funding creator revenue theft. 30 January 2026