SearchJack: 23 Malicious Chrome Extensions Hijack Search Queries via chrome_settings_overrides (Yahoo Affiliate Monetization)
SearchJack: 23 Malicious Chrome Extensions Hijack Search (TL-2026-0812), also tracked as SearchJack, is a high-severity malware campaign, first published 2026-06-15. It is attributed to SearchJack operators with low confidence, affects Google Chrome (Chromium browsers supporting the Chrome Web Store and, maps to 18 MITRE ATT&CK techniques (T1027, T1036, T1041), and is covered by 9 detection rules and 52 indicators of compromise.
Key facts for TL-2026-0812
- Threat ID
- TL-2026-0812
- Also known as
- SearchJack
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-15
- Last reviewed
- 2026-06-15
- Attribution
- SearchJack operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, general public, enterprise endpoints
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 52
Malware and tooling in SearchJack: 23 Malicious Chrome Extensions Hijack Search
Malware and tooling: SearchJack
SearchJack is a coordinated campaign of 23 deceptive Chrome extensions (~758,000 combined installs) that abuse the chrome_settings_overrides manifest key to seize the browser's default search engine, routing every user query through operator-controlled relay domains and a Yahoo Hosted Search affiliate chain for covert monetization. Because the operators control where search traffic flows, the same relay infrastructure can be silently repurposed to serve phishing pages or malicious downloads without any extension update.
How SearchJack: 23 Malicious Chrome Extensions Hijack Search works
MalExt Sentry researchers identified a structured campaign, dubbed SearchJack, of 23 deceptive Chrome Web Store extensions that collectively reached approximately 758,000 installs. Each extension advertises a benign purpose — satellite imagery (Earth, Earth 3D, Satelliten Earth), productivity new-tab pages (PerfecTab Search, NewTab.Search, Great Start), maps (Get Maps & Driving Directions, Best Free Maps), or generic search tools — while its actual function is to monetize the victim's search traffic.
The core technique is abuse of Chrome's built-in `chrome_settings_overrides` manifest key with `is_default: true`, which overrides the browser's default search engine to point at an operator-controlled relay domain. The majority of the extensions are 'shell' or manifest-only wrappers: they contain little beyond the manifest — no requested permissions, no background script, and no content scripts — which lets them pass cursory review and minimizes static-analysis surface. When the user performs a search, the query is first sent to the relay domain (e.g. myperfecttab.com/search/, earthapp.net/admin/public/link), which records it and then 302-redirects through Yahoo Hosted Search to render results that look entirely normal to the victim.
Monetization runs through Yahoo's search affiliate program. The relay operator (broker) is identified by the `hspart` parameter embedded in the final Yahoo redirect URL and earns revenue-sharing payments on each search. MalExt Sentry traced at least eight distinct broker identifiers — trp, infospace (publicly System1), flowsurf, adk, becovi (Becovi Ltd, Dublin), imageadvan, mnet, fc, and dcola — across 22 publishers. System1/infospace-affiliated extensions consistently route through `/admin/public/link` endpoints (earth3d.net, earthapp.net, loginonlineapp.com).
The campaign sits at the boundary between aggressive adware/PUP and genuine security risk. Data collection is real: the Nautilus Search store listing claims it never tracks searches or collects personal data, yet its linked privacy policy explicitly discloses collection of IP addresses, search queries, and device identifiers. More importantly, because the operators fully control the relay tier between the browser and the search results, they can change the destination at any time — switching from benign Yahoo results to phishing landing pages or malicious downloads — entirely server-side and without pushing any new extension code, which is why MalExt Sentry elevated SearchJack above ordinary adware. One outlier, Search Toggler, is not a pure shell: it injects routing logic at runtime via chrome.declarativeNetRequest.updateDynamicRules() in background.js, so its real behavior is invisible to static manifest inspection.
MITRE ATT&CK techniques used in TL-2026-0812
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Collection
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service
Discovery
T1082 System Information Discovery; T1217 Browser Information Discovery
Persistence
collection
T1185 Browser Session Hijacking
Execution
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1608 Stage Capabilities
Impact
stealth
Affected products and versions in SearchJack: 23 Malicious Chrome Extensions Hijack Search
- Google — Chrome (Chromium browsers supporting the Chrome Web Store and chrome_settings_overrides manifest key)
Vulnerable versions: all versions with any of the 23 SearchJack extensions installed
Fixed in: n/a — remediated by removing the extension; not a browser code defect
Remediation for SearchJack: 23 Malicious Chrome Extensions Hijack Search
Immediate actions
- Uninstall any of the 23 listed SearchJack extensions from Chrome (chrome://extensions) and reset the default search engine to a trusted provider
- Block the 23 relay domains at DNS / secure web gateway / proxy (e.g. myperfecttab.com, earthapp.net, oasrchrdr.com, s.fusebase-search.com)
- Enterprise: use Chrome ExtensionInstallBlocklist policy to block the 23 extension IDs and audit currently installed extensions across the fleet
Workarounds
- Set and lock the default search provider via Chrome enterprise policy (DefaultSearchProviderEnabled / DefaultSearchProviderSearchURL) so extensions cannot override it
- Disable user installation of extensions outside an approved allowlist
Longer-term hardening
- Enforce an ExtensionInstallAllowlist (allow-only) policy for managed Chrome browsers
- Deploy browser-extension monitoring/EDR that inspects chrome_settings_overrides search-provider changes and dynamic declarativeNetRequest rule updates
- User awareness: 'new tab' and 'search' utility extensions are a common search-hijack vector; verify publisher and privacy policy before install
Weaknesses (CWE) in SearchJack: 23 Malicious Chrome Extensions Hijack Search
CWE-451, CWE-829, CWE-359
Timeline of SearchJack: 23 Malicious Chrome Extensions Hijack Search
- Earliest SearchJack-associated extension lineage observed (Fusebase Search publisher history dates to 2013), indicating the affiliate-monetization model long predates the 2026 campaign cluster.
- Nautilus Search store listing's claim that it never tracks searches or collects personal data is found to directly contradict its linked privacy policy, which discloses collection of IP addresses, search queries, and device identifiers.
- Search Toggler identified as a non-shell outlier that injects routing logic at runtime via chrome.declarativeNetRequest.updateDynamicRules() in background.js, hiding its true behavior from static manifest inspection.
- Researchers trace eight distinct affiliate brokers via the hspart parameter in final Yahoo redirect URLs (trp, infospace/System1, flowsurf, adk, becovi, imageadvan, mnet, fc, dcola) across 22 publishers, including becovi (Becovi Ltd, Dublin).
- Researchers determine the majority of the 23 extensions are 'shell'/manifest-only wrappers carrying no permissions, background script, or content scripts beyond the chrome_settings_overrides search override, minimizing static-analysis surface and easing store review.
- MalExt Sentry automated scanning system flags 23 Chrome extensions abusing the chrome_settings_overrides manifest key; campaign analysis dated June 9, 2026.
- Fusebase Search shows 609 reviews against only 490 current installs, suggesting prior policy-violation install-count resets or review manipulation.
- Analysts warn the operator-controlled relay tier can be repurposed server-side to serve phishing pages or malicious downloads without any extension update, elevating SearchJack from adware to a security risk.
- Install distribution quantified: three extensions (PerfecTab Search, Quick Search Tool, Better Search) each near ~100,000 installs anchor the campaign's ~758,000-user reach, with a long tail down to Fusebase Search at ~490 installs.
- MalExt Sentry SearchJack report and coordinated coverage (Cyber Security News, GBHackers, Cyberpress) published, documenting ~758,000 affected users, 23 extension IDs, and 23 relay domains.
Sources cited for SearchJack: 23 Malicious Chrome Extensions Hijack Search
- SearchJack: How 23 Browser Extensions Silently Monetize ~758,000 Users' Searches
- SearchJack Campaign Uses 23 Chrome Extensions to Hijack Searches of 758,000 Users
- SearchJack Adware Campaign Exposes 758,000 Users to Privacy and Phishing Risks
- Chrome Extensions Hijack Default Search Engines to Monetize 758,000 Users' Queries
- MDN Web Docs — chrome_settings_overrides manifest key
- MalExt Sentry — Free tool that detects malicious Chrome extensions
Threats related to SearchJack: 23 Malicious Chrome Extensions Hijack Search
Detection coverage for TL-2026-0812
As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0812 across Splunk SPL, Microsoft KQL and Sigma, covering 52 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.