RoguePlanet - 2 million installs, one hijacked search bar

Risk Analysis

Verdict: Search Hijacker. Planet Search declares itself the default search engine and routes every query through a third-party monetization router to nextgeeker[.]com, classified by multiple vendors as a browser hijacker. The listing describes it benignly ("Enchanced default search engine") and requests zero permissions. The entire mechanism is one manifest override:

"chrome_settings_overrides": { "search_provider": {
  "search_url": "https://planet-search[.]com/search/?q={searchTerms}",
  "is_default": true }}

The CRX ships a 0-byte background.js and no host permissions, so nothing is statically detectable in the package itself. The behavior is entirely server-side, resolved after the query leaves the browser.

What it does

planet-search[.]com/search/?q=…
   →301→  sstmaster[.]com/edge/PN1021?q=…      (geo-aware: x-geo-country, no-store)
          →302→  nextgeeker[.]com/B151001.php?q=…&src=PN1021#gsc.q=…   (flagged hijacker)

• Deceptive - posed as a search enhancer. The declared provider (planet-search[.]com) is not the actual destination; every query is silently routed through two undisclosed intermediaries. The listing states only that results are provided by Google.
• No user benefit - the final page renders standard Google Custom Search Element (CSE) results. None of the implied differentiation (independent / region-optimized search) is delivered; the user receives stock Google results reached via three redirects.
• Undisclosed monetization - src=PN1021 ties the extension's traffic to the hijacker network's revenue via an AdSense-for-Search / CSE arrangement. The affiliate relationship is not disclosed in the listing.
• Query exposure - every search string transits planet-search[.]com and sstmaster[.]com, both positioned to observe the full query. (Data retention not independently verified.)
• Server-side only - the redirect logic lives entirely off-device. The CRX is a 0-byte background with a single manifest override, so the mechanism is invisible to static CRX analysis.
• Known-flagged endpoint - nextgeeker[.]com is documented by multiple removal/AV vendors as a browser hijacker/PUP, typically spread via bundleware and extensions posing as "search enhancements." Per those vendors, it harvests search history, visited sites, location and IP (vendor characterization; not independently observed here).

IOCs

Redirect trace (verified)

Chrome UA, FR exit - full chain:

GET planet-search[.]com/search/?q=test
  301 → sstmaster[.]com/edge/PN1021?q=test        (PHP/7.4.33, Cloudflare, x-geo-country: FR, no-store)
  302 → nextgeeker[.]com/B151001.php?q=test&src=PN1021
  200   Google CSE results page                    (PHP/8.3.31, Apache)

Second hop (sstmaster[.]com/edge/PN1021) returns the same 302 to nextgeeker[.]com for curl/8.0 and Googlebot user-agents as for Chrome - no UA-based filtering observed. First hop is geo-aware (x-geo-country) and no-store, so per-request branching by geography is possible but was not characterized across regions.

Timeline

Feed (JSON)

{
  "name": "Planet Search",
  "browser": "chrome",
  "extension_id": "kadaohckdkghfaclhjmkmplebcdcnfnp",
  "category": "searchjacker",
  "verdict": "Search Hijacker",
  "detection_reason": "default-search hijack to flagged nextgeeker[.]com via PN1021",
  "iocs": {
    "domains": ["planet-search[.]com", "sstmaster[.]com", "nextgeeker[.]com"],
    "urls": ["sstmaster[.]com/edge/PN1021", "nextgeeker[.]com/B151001.php"],
    "subid": "PN1021"
  },
  "date": "2026-07-25"
}

Sources

Vendor reports classifying nextgeeker[.]com as a browser hijacker / fake search engine:

• pcrisk: https://www.pcrisk.com/removal-guides/35135-nextgeeker-com-redirect
• SensorsTechForum: https://sensorstechforum.com/nextgeeker-com-fake-search/
• EnigmaSoft (SpyHunter): https://www.enigmasoftware.com/nextgeekercom-removal/
• Gridinsoft: https://blog.gridinsoft.com/nextgeeker-com-redirect-removal/
• MyAntiSpyware: https://www.myantispyware.com/2025/12/19/remove-nextgeeker-com-redirect-chrome-edge-firefox/
• MalwareHelp: https://malwarehelp.co.uk/nextgeeker-com-virus-removal-instructions/
• ITFunk: https://www.itfunk.org/cyber-threats/malware/nextgeeker-com-hijacker
• HowToRemove.guide: https://howtoremove.guide/remove-nextgeeker-com/
• Malware-Guide: https://malware-guide.com/blog/remove-nextgeeker-com