[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fb1JHgohmFhF3TIZMdU61I49kU-_Rzm6omJmPSBk_NM0":3},{"article":4,"iocs":37,"watch_terms":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":11,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":21},"423db520-4f8a-42b4-9beb-409a355ab4a7","There's this fake AdBlock download site: https:\u002F\u002Fadblockplus[.]pro\u002F.\nIt has Russian comments in t...","there-s-this-fake-adblock-download-site-https-adblockplus-pro-it-has-russian-com","There's this fake AdBlock download site: https:\u002F\u002Fadblockplus[.]pro\u002F.\nIt has Russian comments in the source.\nThe domain now is resolving to a Cloudflare IP, but earlier today it resolved to 184.94.213[.]242.\nThen the qugesr[.]online domain, that is being used by North Korean https:\u002F\u002Ft.co\u002FSosOW67ZUf","A malicious domain (adblockplus[.]pro) is impersonating the legitimate AdBlock Plus browser extension to distribute malware. The site contains Russian-language comments in its source code and has been hosted on IP 184.94.213[.]242. The domain is connected to North Korean threat activity via the qugesr[.]online infrastructure.","Fake AdBlock download site impersonating legitimate extension, linked to North Korean threat actors.",null,"https:\u002F\u002Fx.com\u002Fmalwrhunterteam\u002Fstatus\u002F2036158996554637591","2026-03-23T19:11:49+00:00","2026-03-23T20:00:14.845487+00:00",8,[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":17,"icon":11,"name":19,"slug":20},"Malware","malware",[22,27,32],{"category":23},{"id":24,"icon":11,"name":25,"slug":26},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":28},{"id":29,"icon":11,"name":30,"slug":31},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":33},{"id":34,"icon":11,"name":35,"slug":36},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[38,42,46],{"type":39,"value":40,"context":41},"domain","adblockplus[.]pro","Fake AdBlock Plus download site distributing malware",{"type":43,"value":44,"context":45},"ip","184.94.213[.]242","Previous hosting IP for fake AdBlock domain",{"type":39,"value":47,"context":48},"qugesr[.]online","Infrastructure associated with North Korean threat actors",[]]