CyberSIXT Search
Original
Image: SecurityOnline

SecurityOnlineDdos

Scam Alert: “Amazon Ads Blocker” Extension Hijacks Creator Commissions

A Chrome extension marketed as improving Amazon shopping is exposed as a malicious tool that hijacks creator commissions by automatically injecting the developer’s affiliate tag (10xprofit-20) into every Amazon product link and replacing existing affiliate codes from content creators, despite also advertising ad blocking. The reveal notes that while the extension blocks ads, its primary hidden function is affiliate hijacking, enabling the developer to receive the full commission.

By using a MutationObserver to watch the user’s browsing in real time, the extension maintains control over affiliate tags even as Amazon loads new products via infinite scroll or AJAX requests. A misleading disclosure claimed commissions are earned when a coupon code or deal is revealed, which Socket’s Threat Research Team says is false, with the report describing a mismatch between disclosure and implementation.

The analysis also states the code violates Google’s policies by providing no user benefit for the injection and notes Chrome Web Store policies banning such behaviour; the extension remained available in the store at the time of writing. According to Socket’s Threat Research Team, users should uninstall the extension to stop unknowingly funding creator revenue theft. 30 January 2026

Sources

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.

↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device