A coordinated campaign of 23 seemingly legitimate Chrome extensions tracked as “SearchJack” has quietly hijacked the default search settings of roughly 758,000 users, routing queries through operator-controlled monetization middleware before returning results.
At first glance the extensions promise useful features satellite imagery, productivity tools, news readers, maps but their true purpose is affiliate search monetization, primarily using hosted search partners such as Yahoo and multi-network affiliate brokers.
Malicious behavior in SearchJack is straightforward and stealthy. Each extension abuses the chrome_settings_overrides manifest key to set itself as the browser’s default search engine.
Many extensions are minimal manifest-only wrappers with no permissions or background scripts enough to pass static store review while a subset contains superficial functionality (e.g., map viewers or video search) that masks the real business: redirecting searches through a chain that credits affiliate brokers.
The scanner attributed at least eight distinct hspart brokers through the hspart parameter embedded in final Yahoo redirect URLs; notable broker identifiers include trp, infospace (System1), flowsurf, adk, becovi, imageadvan, mnet, fc and dcola.
The campaign, analyzed June 9, 2026, by the MalExt Sentry automated scanner, demonstrates a scalable broker-driven model that evades standard store policing and creates persistent privacy and phishing risks.
Campaign Overview
| Campaign Name | SearchJack |
| Extensions Identified | 23 |
| Unique Publishers | 22 |
| Total Affected Users | ~758,000 |
| Brokers Identified | 8 |
| Primary Monetization | Hosted Search Affiliate (Yahoo, multi-network) |
| Date of Analysis | June 09, 2026 |
Broker relationships persist independently of individual extension lifecycles, meaning disposable publisher accounts can be rotated without disrupting revenue flow.
The extensions vary in install counts and presentation but share a clear infrastructure pattern. Examples include extensions with six-figure installs PerfecTab Search, Quick Search Tool, and Better Search each list around 100K installs and many others in the 2K–70K range.
Several anomalies stand out: Nautilus Search claims “we don’t track your searches” in its store listing while its privacy policy discloses collection of IPs and query logs; Search Toggler implements a visible engine-switching UI but injects runtime redirect rules via chrome.declarativeNetRequest.updateDynamicRules(), keeping the actual middleware routing invisible to static analysis; Fusebase Search shows an implausible review/install ratio that suggests review manipulation or repurposing.
Publisher identities are inconsistent or anonymous: some extensions list no credible corporate owner while privacy policies reference unrelated entities, undermining accountability.
This model matters because it elevates the campaign from adware to an active security threat. Every search query is exposed to anonymous third parties, creating large-scale surveillance of user intent and technical identifiers.
More critically, operators who control the middleware can change payloads centrally switching from benign monetized results to phishing pages, credential-harvesting sites, or malicious downloads without changing extension code or triggering store re-review.
The campaign’s broker-centric structure makes takedowns of individual extensions ineffective unless platform-level enforcement targets the affiliate accounts and hosted-search infrastructure.
Technical attribution and indicators are clear: the MalExt Sentry identified 23 extensions, 22 unique publishers, roughly ~758,000 impacted users, and eight monetization brokers.
The full corpus and mapping of extension IDs to search URLs and hspart values show consistent use of Yahoo hosted search redirects (yhs-* parameters) and repeated backend templates such as /admin/public/link endpoints for System1/infospace-affiliated traffic.
These artifacts provide immediate triage paths for platform operators: revoke affiliate partner credentials linked to the hspart parameters, audit and suspend publisher accounts that exhibit shell patterns, and block or flag domains used as intermediary search endpoints.
Mitigation requires coordinated action: Chrome Web Store and other browser extension platforms must enforce stronger publisher verification, runtime behavior scanning, and affiliate-account audits; security teams should detect and remove chrome_settings_overrides changes, inspect redirect chains for hspart parameters, and notify affected users to reset search defaults and remove suspicious extensions.
Regulators may also find grounds for enforcement where store listings make affirmative false privacy claims, as in Nautilus Search. Until broker-level controls are tightened, SearchJack-style campaigns will remain a profitable and resilient vector for privacy invasion and large-scale phishing risk.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…