Google Play Store Allows Spyware‑Laden ‘Poper Blocker’ to Reach Millions

A browser extension called Poper Blocker, listed as an ad‑blocking tool in the Chrome Web Store, has been identified as spyware that has been downloaded by millions of users worldwide.

Technical analysis by security researchers shows the extension silently captures a broad range of data, including URLs, cookies, login credentials and other identifying information, and transmits it to remote servers under the control of the developers.

The extension managed to pass Google’s automated review process and display the familiar Google verification badge, giving users the impression that it had been vetted for safety.

Researchers who uncovered the behavior warned the security community and submitted reports to Google, but the extension remained available for weeks after the initial discovery.

The incident highlights a recurring challenge for the Chrome Web Store, where the sheer volume of submissions can make comprehensive manual review difficult, and where malicious actors frequently masquerade as legitimate utilities such as ad blockers.

Security experts recommend that users remove Poper Blocker immediately, review their browser extensions, and consider using reputable sources for privacy tools. Google has not issued a public statement, but the episode is likely to pressure the company to tighten its extension vetting procedures.