# SearchJack: 23 Malicious Chrome Extensions Hijack Search Queries via chrome_settings_overrides (Yahoo Affiliate Monetization)

> SearchJack is a coordinated campaign of 23 deceptive Chrome extensions (~758,000 combined installs) that abuse the chrome_settings_overrides manifest key to seize the browser's default search engine, routing every user query through operator-controlled relay domains and a Yahoo Hosted Search affiliate chain for covert monetization. Because the operators control where search traffic flows, the same relay infrastructure can be silently repurposed to serve phishing pages or malicious downloads without any extension update.

- **Published:** 2026-06-15T00:00:00Z
- **Last reviewed:** 2026-06-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0812
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-searchjack-chrome-extension-hijack-tl-2026-0812.webp?v=d9f62a51 (Threadlinqs threat intel: SearchJack 23 Chrome Extensions: Detection & IOCs (TL-2026-0812) — High severity, 52 IOCs, 9 detection rules.)
- **ID:** TL-2026-0812
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** SearchJack operators
- **Detections:** 9 (1 shown free below) · **IOCs:** 52 (3 shown free below)

## Description

MalExt Sentry researchers identified a structured campaign, dubbed SearchJack, of 23 deceptive Chrome Web Store extensions that collectively reached approximately 758,000 installs. Each extension advertises a benign purpose — satellite imagery (Earth, Earth 3D, Satelliten Earth), productivity new-tab pages (PerfecTab Search, NewTab.Search, Great Start), maps (Get Maps & Driving Directions, Best Free Maps), or generic search tools — while its actual function is to monetize the victim's search traffic.

The core technique is abuse of Chrome's built-in `chrome_settings_overrides` manifest key with `is_default: true`, which overrides the browser's default search engine to point at an operator-controlled relay domain. The majority of the extensions are 'shell' or manifest-only wrappers: they contain little beyond the manifest — no requested permissions, no background script, and no content scripts — which lets them pass cursory review and minimizes static-analysis surface. When the user performs a search, the query is first sent to the relay domain (e.g. myperfecttab.com/search/, earthapp.net/admin/public/link), which records it and then 302-redirects through Yahoo Hosted Search to render results that look entirely normal to the victim.

Monetization runs through Yahoo's search affiliate program. The relay operator (broker) is identified by the `hspart` parameter embedded in the final Yahoo redirect URL and earns revenue-sharing payments on each search. MalExt Sentry traced at least eight distinct broker identifiers — trp, infospace (publicly System1), flowsurf, adk, becovi (Becovi Ltd, Dublin), imageadvan, mnet, fc, and dcola — across 22 publishers. System1/infospace-affiliated extensions consistently route through `/admin/public/link` endpoints (earth3d.net, earthapp.net, loginonlineapp.com).

The campaign sits at the boundary between aggressive adware/PUP and genuine security risk. Data collection is real: the Nautilus Search store listing claims it never tracks searches or collects personal data, yet its linked privacy policy explicitly discloses collection of IP addresses, search queries, and device identifiers. More importantly, because the operators fully control the relay tier between the browser and the search results, they can change the destination at any time — switching from benign Yahoo results to phishing landing pages or malicious downloads — entirely server-side and without pushing any new extension code, which is why MalExt Sentry elevated SearchJack above ordinary adware. One outlier, Search Toggler, is not a pure shell: it injects routing logic at runtime via chrome.declarativeNetRequest.updateDynamicRules() in background.js, so its real behavior is invisible to static manifest inspection.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1204 User Execution
- T1176 Software Extensions
- T1036 Masquerading
- T1684.001 Impersonation
- T1027 Obfuscated Files or Information
- T1185 Browser Session Hijacking
- T1217 Browser Information Discovery
- T1082 System Information Discovery
- T1056 Input Capture
- T1071 Application Layer Protocol
- T1090 Proxy
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SearchJack — Relay Redirect Chain & hspart Affiliate Monetization (C2 / Traffic Routing)** (`TL-2026-0812-SPL-003`)

Detects the SearchJack command-and-control / monetization tier in web-proxy or DNS telemetry: search queries transiting an operator-controlled relay (known SearchJack relay domains, /admin/public/link, /serp.php, /auto-suggest/search.php, /ext/search paths) and final Yahoo Hosted Search (/yhs/search) URLs carrying an hspart= broker identifier. This captures query interception and affiliate-fraud redirect behavior regardless of which extension delivered it.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1090, T1102, T1657
- **Data sources:** proxy, microsoft_defender_for_endpoint, dns
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy (sourcetype="bluecoat:proxysg" OR sourcetype="pan:traffic" OR sourcetype="zscalernss-web" OR sourcetype="squid:access")
| eval host=lower(coalesce(cs_host, dest_host, url_domain))
| eval uri=coalesce(cs_uri, url, uri_path)
| eval relay_hit=if(host IN("myperfecttab.com","quicksearchtool.com","getbettersearch-api.com","newtab.club","nautilus-notes.com","earthapp.net","wanderlustar.com","templatesearch-svc.org","earth3d.net","myfocalfind.com","greatstartapp.com","freshfruittab.com","viewmenuprices.com","searchtoggler.com","loginonlineapp.com","searchthatweb.com","freshysearch-api.net","myvideolibrary.info","bestfreemaps.com","searchanything.co","oasrchrdr.com","fusebase-search.com","worthathousandwords.com"), 1, 0)
| eval path_hit=if(match(uri, "(/admin/public/link|/serp\.php|/auto-suggest/search\.php|/ext/search|/search/\?q=|/yhs/search)"), 1, 0)
| eval hspart_hit=if(match(uri, "hspart=(trp|infospace|flowsurf|adk|becovi|imageadvan|mnet|fc|dcola)"), 1, 0)
| where relay_hit=1 OR hspart_hit=1 OR (path_hit=1 AND match(uri, "hspart="))
| stats count values(uri) as uris min(_time) as firstSeen max(_time) as lastSeen by src_ip, user, host
| eval firstSeen=strftime(firstSeen,"%Y-%m-%d %H:%M:%S")
| sort - count
| table firstSeen lastSeen src_ip user host uris count
```

### Microsoft KQL

```kql
// Microsoft Sentinel / MDE network — SearchJack relay redirect + hspart affiliate footprint
let relay_domains = dynamic(["myperfecttab.com","quicksearchtool.com","getbettersearch-api.com","newtab.club","nautilus-notes.com","earthapp.net","wanderlustar.com","templatesearch-svc.org","earth3d.net","myfocalfind.com","greatstartapp.com","freshfruittab.com","viewmenuprices.com","searchtoggler.com","loginonlineapp.com","searchthatweb.com","freshysearch-api.net","myvideolibrary.info","bestfreemaps.com","searchanything.co","oasrchrdr.com","fusebase-search.com","worthathousandwords.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (relay_domains)
    or RemoteUrl matches regex @"hspart=(trp|infospace|flowsurf|adk|becovi|imageadvan|mnet|fc|dcola)"
    or RemoteUrl has_any ("/admin/public/link", "/serp.php", "/auto-suggest/search.php", "/ext/search", "/yhs/search")
| extend HspartBroker = extract(@"hspart=([a-z0-9]+)", 1, RemoteUrl)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, HspartBroker
| order by Timestamp desc
```

### Sigma

```yaml
title: SearchJack Search Relay Redirect with hspart Affiliate Parameter
id: c3e7b1a9-5d2f-4c8a-9e6b-2f4a7c1d3b8e
status: experimental
description: Detects outbound search traffic transiting known SearchJack relay domains or relay endpoint paths (/admin/public/link, /serp.php, /auto-suggest/search.php, /ext/search) and Yahoo Hosted Search URLs (/yhs/search) carrying an hspart broker identifier used for affiliate monetization.
references:
    - https://malext.io/reports/SearchJack/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/15
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1090
    - attack.t1102
    - attack.impact
    - attack.t1657
logsource:
    category: proxy
detection:
    selection_domains:
        c-uri|contains:
            - 'myperfecttab.com'
            - 'getbettersearch-api.com'
            - 'earthapp.net'
            - 'earth3d.net'
            - 'loginonlineapp.com'
            - 'oasrchrdr.com'
            - 'fusebase-search.com'
    selection_hspart:
        c-uri|contains:
            - 'hspart=trp'
            - 'hspart=infospace'
            - 'hspart=becovi'
            - 'hspart=flowsurf'
            - 'hspart=adk'
    selection_paths:
        c-uri|contains:
            - '/admin/public/link'
            - '/serp.php'
            - '/auto-suggest/search.php'
            - '/ext/search'
            - '/yhs/search'
    condition: selection_domains or selection_hspart or (selection_paths and selection_hspart)
fields:
    - c-uri
    - cs-host
    - src_ip
falsepositives:
    - Legitimate Yahoo Hosted Search partners also use hspart; scope to the documented SearchJack relay domains and broker IDs to avoid flagging sanctioned partners
level: high
```

**Known false positives:**

- The hspart parameter is shared by all Yahoo Hosted Search affiliates, some of which are sanctioned; restrict alerting to the documented SearchJack relay domains and the eight known broker IDs

**Tuning notes:** Block/alert on the 23 relay domains via DNS or SWG and tune the hspart broker list to the eight documented identifiers. Suppress legitimate sanctioned Yahoo partners by allowlisting their hspart values; raise severity when a relay domain and an hspart broker co-occur in the same redirect chain.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SearchJack — Known Malicious Extension ID Loaded in Chromium Browser (Exploitation) (locked: unlock with TL Creds)
- SearchJack — Search Query Interception & Device Identifier Collection at Relay (Post-Exploitation) (locked: unlock with TL Creds)
- SearchJack — System1/infospace Relay Endpoint & 302 Redirect to Yahoo Hosted Search (C2 Routing) (locked: unlock with TL Creds)
- SearchJack — chrome_settings_overrides Search Provider Override with is_default true (Exploitation) (locked: unlock with TL Creds)
- SearchJack — declarativeNetRequest Dynamic Rule Injection for Search Redirect (Post-Exploitation / Evasion) (locked: unlock with TL Creds)
- SearchJack — Relay Search Path & hspart Broker in Outbound Web Traffic (C2 / Monetization) (locked: unlock with TL Creds)
- SearchJack — Malicious Chrome Extension Install & chrome_settings_overrides Manifest Hijack (Exploitation) (locked: unlock with TL Creds)
- SearchJack — Default Search Provider Hijack in Chrome Secure Preferences (Post-Exploitation) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 52)

Defanged, TLP:CLEAR.

- Domain: `myperfecttab[.]com`
- Domain: `quicksearchtool[.]com`
- Domain: `getbettersearch-api[.]com`

Full set of 52 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SearchJack: How 23 Browser Extensions Silently Monetize ~758,000 Users' Searches](https://malext.io/reports/SearchJack/)
- [SearchJack Campaign Uses 23 Chrome Extensions to Hijack Searches of 758,000 Users](https://cybersecuritynews.com/searchjack-campaign-uses-23-chrome-extensions/)
- [SearchJack Adware Campaign Exposes 758,000 Users to Privacy and Phishing Risks](https://gbhackers.com/searchjack-adware-campaign/)
- [Chrome Extensions Hijack Default Search Engines to Monetize 758,000 Users' Queries](https://cyberpress.org/chrome-extensions-hijack-searches/)
- [MDN Web Docs — chrome_settings_overrides manifest key](https://developer.mozilla.org/Add-ons/WebExtensions/manifest.json/chrome_settings_overrides)
- [MalExt Sentry — Free tool that detects malicious Chrome extensions](https://chromewebstore.google.com/detail/malext-sentry/bpohikihiogjgmebpnbgnloipjaddibe)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0812