Do Son 
A popular Chrome extension promising to clean up your Amazon shopping experience is actually a cleverly disguised tool for stealing revenue from content creators. Socket’s Threat Research Team has exposed “Amazon Ads Blocker,” a malicious extension that hides its primary function: hijacking affiliate links to divert commissions into the developer’s pocket.
While the extension does block ads as advertised, its real goal is financial. “Its primary function is hidden: it automatically injects the developer’s affiliate tag (10xprofit-20) into every Amazon product link and replaces existing affiliate codes from content creators,” the report reveals.
Affiliate marketing is the lifeblood of many online creators. When a YouTuber or blogger recommends a product, they use a special link with a unique tag (e.g., creator-20) to earn a small commission from Amazon.
This extension breaks that promise. “A YouTuber recommending a product with tag creator-20 will see their tag replaced with 10xprofit-20 before the user completes the purchase,” the researchers explain. “The creator earns nothing while the extension developer receives the full commission.”
By using a MutationObserver to watch the user’s browsing in real-time, the extension ensures it never misses a chance to cash in. “This ensures the extension maintains control over affiliate tags even when Amazon loads new products via infinite scroll or AJAX requests.”
The extension’s developer attempted to cover their tracks with a misleading disclosure, claiming they earn commissions “when you reveal a coupon code or deal.” But Socket’s analysis proves this is a lie.
“The disclosure describes a fundamentally different product than what the code implements,” the report notes. “The actual product is an ad blocker with automatic link modification. This mismatch between disclosure and implementation creates false consent.”
Crucially, the code violates Google’s policies because it offers no user benefit for the injection. “The extension provides no discount, cashback, or donation. Ad blocking is unrelated to affiliate injection.”
This tactic isn’t just unethical; it’s a direct violation of Chrome Web Store policies implemented after the infamous “PayPal Honey” incident. Google explicitly bans extensions that “replace existing affiliate codes” or fail to provide transparent user benefits.
Despite these violations, “The Amazon Ads Blocker extension remains available in the Chrome Web Store at the time of writing,” putting both users and creators at continued risk.
Socket warns that while the code isn’t stealing passwords or credit cards, it “impose[s] a high security/privacy/ethics risk and should be treated as malicious in intent.” Users are advised to uninstall the extension immediately to stop unknowingly funding the theft of creator revenue.
Related Posts:
- YouTube’s Ad Blocker Crackdown Intensifies: No More Free Rides!
- Google’s New YouTube Warning: No Ad Blockers or Lose Your Account?
- YouTube’s New Anti-Ad Blocker Tactic: “Fake Buffering” Delays Videos by 10+ Seconds
- A German Court Just Revived a Lawsuit That Could Make Ad Blockers Illegal
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
