Another cluster of potentially malicious Chrome extensions

We’ve already seen Chrome extensions containing obfuscated malicious code. We’ve also seen PCVARK’s malicious ad blockers. When looking for more PCVARK extensions, I stumbled upon an inconspicuous extension called “Translator - Select to Translate.” The only unusual thing about it were its reviews, lots of raving positive reviews mixed with usability complains. That, and the permissions: why does a translator extension need webRequest and webRequestBlocking permissions?

When I looked into this extension, I immediately discovered a strange code …

ad blockers called chrome chrome extensions cluster code extension extensions malicious obfuscated reviews select translate translator usability