SearchJack: 23 Malicious Chrome Extensions Hijack Search Queries via chrome_settings_overrides (Yahoo Affiliate Monetization)

Key facts for SearchJack Chrome extension hijack

Detection coverage for SearchJack Chrome extension hijack

As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0812 across Splunk SPL, Microsoft KQL and Sigma, covering 52 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SearchJack — Relay Redirect Chain & hspart Affiliate Monetization (C2 / Traffic Routing)

Detects the SearchJack command-and-control / monetization tier in web-proxy or DNS telemetry: search queries transiting an operator-controlled relay (known SearchJack relay domains, /admin/public/link, /serp.php, /auto-suggest/search.php, /ext/search paths) and final Yahoo Hosted Search (/yhs/search) URLs carrying an hspart= broker identifier. This captures query interception and affiliate-fraud redirect behavior regardless of which extension delivered it.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1090, T1102, T1657
• Data sources: proxy, microsoft_defender_for_endpoint, dns
• Severity: high
• Confidence: high

Splunk SPL

index=proxy (sourcetype="bluecoat:proxysg" OR sourcetype="pan:traffic" OR sourcetype="zscalernss-web" OR sourcetype="squid:access")
| eval host=lower(coalesce(cs_host, dest_host, url_domain))
| eval uri=coalesce(cs_uri, url, uri_path)
| eval relay_hit=if(host IN("myperfecttab.com","quicksearchtool.com","getbettersearch-api.com","newtab.club","nautilus-notes.com","earthapp.net","wanderlustar.com","templatesearch-svc.org","earth3d.net","myfocalfind.com","greatstartapp.com","freshfruittab.com","viewmenuprices.com","searchtoggler.com","loginonlineapp.com","searchthatweb.com","freshysearch-api.net","myvideolibrary.info","bestfreemaps.com","searchanything.co","oasrchrdr.com","fusebase-search.com","worthathousandwords.com"), 1, 0)
| eval path_hit=if(match(uri, "(/admin/public/link|/serp\.php|/auto-suggest/search\.php|/ext/search|/search/\?q=|/yhs/search)"), 1, 0)
| eval hspart_hit=if(match(uri, "hspart=(trp|infospace|flowsurf|adk|becovi|imageadvan|mnet|fc|dcola)"), 1, 0)
| where relay_hit=1 OR hspart_hit=1 OR (path_hit=1 AND match(uri, "hspart="))
| stats count values(uri) as uris min(_time) as firstSeen max(_time) as lastSeen by src_ip, user, host
| eval firstSeen=strftime(firstSeen,"%Y-%m-%d %H:%M:%S")
| sort - count
| table firstSeen lastSeen src_ip user host uris count

Microsoft KQL

// Microsoft Sentinel / MDE network — SearchJack relay redirect + hspart affiliate footprint
let relay_domains = dynamic(["myperfecttab.com","quicksearchtool.com","getbettersearch-api.com","newtab.club","nautilus-notes.com","earthapp.net","wanderlustar.com","templatesearch-svc.org","earth3d.net","myfocalfind.com","greatstartapp.com","freshfruittab.com","viewmenuprices.com","searchtoggler.com","loginonlineapp.com","searchthatweb.com","freshysearch-api.net","myvideolibrary.info","bestfreemaps.com","searchanything.co","oasrchrdr.com","fusebase-search.com","worthathousandwords.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (relay_domains)
    or RemoteUrl matches regex @"hspart=(trp|infospace|flowsurf|adk|becovi|imageadvan|mnet|fc|dcola)"
    or RemoteUrl has_any ("/admin/public/link", "/serp.php", "/auto-suggest/search.php", "/ext/search", "/yhs/search")
| extend HspartBroker = extract(@"hspart=([a-z0-9]+)", 1, RemoteUrl)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, HspartBroker
| order by Timestamp desc

Sigma

title: SearchJack Search Relay Redirect with hspart Affiliate Parameter
id: c3e7b1a9-5d2f-4c8a-9e6b-2f4a7c1d3b8e
status: experimental
description: Detects outbound search traffic transiting known SearchJack relay domains or relay endpoint paths (/admin/public/link, /serp.php, /auto-suggest/search.php, /ext/search) and Yahoo Hosted Search URLs (/yhs/search) carrying an hspart broker identifier used for affiliate monetization.
references:
    - https://malext.io/reports/SearchJack/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/15
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1090
    - attack.t1102
    - attack.impact
    - attack.t1657
logsource:
    category: proxy
detection:
    selection_domains:
        c-uri|contains:
            - 'myperfecttab.com'
            - 'getbettersearch-api.com'
            - 'earthapp.net'
            - 'earth3d.net'
            - 'loginonlineapp.com'
            - 'oasrchrdr.com'
            - 'fusebase-search.com'
    selection_hspart:
        c-uri|contains:
            - 'hspart=trp'
            - 'hspart=infospace'
            - 'hspart=becovi'
            - 'hspart=flowsurf'
            - 'hspart=adk'
    selection_paths:
        c-uri|contains:
            - '/admin/public/link'
            - '/serp.php'
            - '/auto-suggest/search.php'
            - '/ext/search'
            - '/yhs/search'
    condition: selection_domains or selection_hspart or (selection_paths and selection_hspart)
fields:
    - c-uri
    - cs-host
    - src_ip
falsepositives:
    - Legitimate Yahoo Hosted Search partners also use hspart; scope to the documented SearchJack relay domains and broker IDs to avoid flagging sanctioned partners
level: high

Known false positives:

• The hspart parameter is shared by all Yahoo Hosted Search affiliates, some of which are sanctioned; restrict alerting to the documented SearchJack relay domains and the eight known broker IDs

Tuning notes: Block/alert on the 23 relay domains via DNS or SWG and tune the hspart broker list to the eight documented identifiers. Suppress legitimate sanctioned Yahoo partners by allowlisting their hspart values; raise severity when a relay domain and an hspart broker co-occur in the same redirect chain.

• 🔒 SearchJack — Known Malicious Extension ID Loaded in Chromium Browser (Exploitation) · unlock with TL Creds
• 🔒 SearchJack — Search Query Interception & Device Identifier Collection at Relay (Post-Exploitation) · unlock with TL Creds
• 🔒 SearchJack — System1/infospace Relay Endpoint & 302 Redirect to Yahoo Hosted Search (C2 Routing) · unlock with TL Creds
• 🔒 SearchJack — chrome_settings_overrides Search Provider Override with is_default true (Exploitation) · unlock with TL Creds
• 🔒 SearchJack — declarativeNetRequest Dynamic Rule Injection for Search Redirect (Post-Exploitation / Evasion) · unlock with TL Creds
• 🔒 SearchJack — Relay Search Path & hspart Broker in Outbound Web Traffic (C2 / Monetization) · unlock with TL Creds
• 🔒 SearchJack — Malicious Chrome Extension Install & chrome_settings_overrides Manifest Hijack (Exploitation) · unlock with TL Creds
• 🔒 SearchJack — Default Search Provider Hijack in Chrome Secure Preferences (Post-Exploitation) · unlock with TL Creds

Indicators of compromise for SearchJack Chrome extension hijack

As of 2026-06-15, Threadlinqs Intelligence tracks 52 indicators of compromise for TL-2026-0812.

Sample indicators (3 of 52)

• Domain: myperfecttab[.]com
• Domain: quicksearchtool[.]com
• Domain: getbettersearch-api[.]com

Defanged, TLP:CLEAR. Full set of 52 indicators: unlock with TL Creds.

How SearchJack Chrome extension hijack works

Because the operators control where search traffic flows, the same relay infrastructure can be silently repurposed to serve phishing pages or malicious downloads without any extension update.

MalExt Sentry researchers identified a structured campaign, dubbed SearchJack, of 23 deceptive Chrome Web Store extensions that collectively reached approximately 758,000 installs. Each extension advertises a benign purpose — satellite imagery (Earth, Earth 3D, Satelliten Earth), productivity new-tab pages (PerfecTab Search, NewTab.Search, Great Start), maps (Get Maps & Driving Directions, Best Free Maps), or generic search tools — while its actual function is to monetize the victim's search traffic.

The core technique is abuse of Chrome's built-in `chrome_settings_overrides` manifest key with `is_default: true`, which overrides the browser's default search engine to point at an operator-controlled relay domain. The majority of the extensions are 'shell' or manifest-only wrappers: they contain little beyond the manifest — no requested permissions, no background script, and no content scripts — which lets them pass cursory review and minimizes static-analysis surface. When the user performs a search, the query is first sent to the relay domain (e.g. myperfecttab.com/search/, earthapp.net/admin/public/link), which records it and then 302-redirects through Yahoo Hosted Search to render results that look entirely normal to the victim.

Monetization runs through Yahoo's search affiliate program. The relay operator (broker) is identified by the `hspart` parameter embedded in the final Yahoo redirect URL and earns revenue-sharing payments on each search. MalExt Sentry traced at least eight distinct broker identifiers — trp, infospace (publicly System1), flowsurf, adk, becovi (Becovi Ltd, Dublin), imageadvan, mnet, fc, and dcola — across 22 publishers. System1/infospace-affiliated extensions consistently route through `/admin/public/link` endpoints (earth3d.net, earthapp.net, loginonlineapp.com).

The campaign sits at the boundary between aggressive adware/PUP and genuine security risk. Data collection is real: the Nautilus Search store listing claims it never tracks searches or collects personal data, yet its linked privacy policy explicitly discloses collection of IP addresses, search queries, and device identifiers. More importantly, because the operators fully control the relay tier between the browser and the search results, they can change the destination at any time — switching from benign Yahoo results to phishing landing pages or malicious downloads — entirely server-side and without pushing any new extension code, which is why MalExt Sentry elevated SearchJack above ordinary adware. One outlier, Search Toggler, is not a pure shell: it injects routing logic at runtime via chrome.declarativeNetRequest.updateDynamicRules() in background.js, so its real behavior is invisible to static manifest inspection.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Collection

T1056 Input Capture

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service

Discovery

T1082 System Information Discovery; T1217 Browser Information Discovery

Persistence

T1176 Software Extensions

collection

T1185 Browser Session Hijacking

Execution

T1204 User Execution

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1608 Stage Capabilities

Impact

T1657 Financial Theft

stealth

T1684.001 Impersonation

Remediation for SearchJack Chrome extension hijack

Immediate actions

• Uninstall any of the 23 listed SearchJack extensions from Chrome (chrome://extensions) and reset the default search engine to a trusted provider
• Block the 23 relay domains at DNS / secure web gateway / proxy (e.g. myperfecttab.com, earthapp.net, oasrchrdr.com, s.fusebase-search.com)
• Enterprise: use Chrome ExtensionInstallBlocklist policy to block the 23 extension IDs and audit currently installed extensions across the fleet

Workarounds

• Set and lock the default search provider via Chrome enterprise policy (DefaultSearchProviderEnabled / DefaultSearchProviderSearchURL) so extensions cannot override it
• Disable user installation of extensions outside an approved allowlist

Longer-term hardening

• Enforce an ExtensionInstallAllowlist (allow-only) policy for managed Chrome browsers
• Deploy browser-extension monitoring/EDR that inspects chrome_settings_overrides search-provider changes and dynamic declarativeNetRequest rule updates
• User awareness: 'new tab' and 'search' utility extensions are a common search-hijack vector; verify publisher and privacy policy before install

Affected and fixed versions

• Google — Chrome (Chromium browsers supporting the Chrome Web Store and chrome_settings_overrides manifest key)
  Vulnerable versions: all versions with any of the 23 SearchJack extensions installed
  Fixed in: n/a — remediated by removing the extension; not a browser code defect

Timeline of SearchJack Chrome extension hijack

• 2013-01-01 Earliest SearchJack-associated extension lineage observed (Fusebase Search publisher history dates to 2013), indicating the affiliate-monetization model long predates the 2026 campaign cluster.
• 2026-06-09 Nautilus Search store listing's claim that it never tracks searches or collects personal data is found to directly contradict its linked privacy policy, which discloses collection of IP addresses, search queries, and device identifiers.
• 2026-06-09 Search Toggler identified as a non-shell outlier that injects routing logic at runtime via locked-ioc-3 in background.js, hiding its true behavior from static manifest inspection.
• 2026-06-09 Researchers trace eight distinct affiliate brokers via the hspart parameter in final Yahoo redirect URLs (trp, infospace/System1, flowsurf, adk, becovi, imageadvan, mnet, fc, dcola) across 22 publishers, including becovi (locked-ioc-52, Dublin).
• 2026-06-09 Researchers determine the majority of the 23 extensions are 'shell'/manifest-only wrappers carrying no permissions, background script, or content scripts beyond the chrome_settings_overrides search override, minimizing static-analysis surface and easing store review.
• 2026-06-09 MalExt Sentry automated scanning system flags 23 Chrome extensions abusing the chrome_settings_overrides manifest key; campaign analysis dated June 9, 2026.
• 2026-06-15 Fusebase Search shows 609 reviews against only 490 current installs, suggesting prior policy-violation install-count resets or review manipulation.
• 2026-06-15 Analysts warn the operator-controlled relay tier can be repurposed server-side to serve phishing pages or malicious downloads without any extension update, elevating SearchJack from adware to a security risk.
• 2026-06-15 Install distribution quantified: three extensions (PerfecTab Search, Quick Search Tool, Better Search) each near ~100,000 installs anchor the campaign's ~758,000-user reach, with a long tail down to Fusebase Search at ~490 installs.
• 2026-06-15 MalExt Sentry SearchJack report and coordinated coverage (Cyber Security News, GBHackers, Cyberpress) published, documenting ~758,000 affected users, 23 extension IDs, and 23 relay domains.

Sources cited for SearchJack Chrome extension hijack

• SearchJack: How 23 Browser Extensions Silently Monetize ~758,000 Users' Searches malext.io · Research · 2026-06-09
• MDN Web Docs — chrome_settings_overrides manifest key developer.mozilla.org · Vendor report · 2026-06-15
• MalExt Sentry — Free tool that detects malicious Chrome extensions chromewebstore.google.com · Vendor report · 2026-06-15
• SearchJack Campaign Uses 23 Chrome Extensions to Hijack Searches of 758,000 Users cybersecuritynews.com · News · 2026-06-15
• SearchJack Adware Campaign Exposes 758,000 Users to Privacy and Phishing Risks gbhackers.com · News · 2026-06-15
• Chrome Extensions Hijack Default Search Engines to Monetize 758,000 Users' Queries cyberpress.org · News · 2026-06-15

Threats related to SearchJack Chrome extension hijack

• ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M Installs) Contains Dormant AES-GCM Browsing-History Exfiltration Pipeline to api.stanfordstudies.com

Previous and next in malware

• Velvet Ant (China-Nexus) 'Operation Highland' — Backdoored pam_unix.so PAM Module and Trojanized OpenSSH for Decade-Long Credential Theft in an Isolated Network Previous report
• EtherRAT: Node.js Remote Access Trojan with Ethereum Blockchain C2 Resolution and Per-Execution Self-Reobfuscation Next report