SearchJack: How 23 Browser Extensions Silently Monetize ~758,000 Users' Searches

Campaign Overview

SearchJack is a campaign of 23 deceptive Chrome browser extensions that silently override users' default search engines and route queries through monetization middleware before delivering results. Each extension presents a different advertised purpose - satellite imagery, productivity tools, news readers, maps - while the actual business is search affiliate revenue. The campaign spans at least 8 distinct monetization brokers and ~758,000 affected users.

Data for this report was collected using the MalExt Sentry automated scanner. We continuously monitor browser extension stores and flag suspicious items based on specific keywords in their descriptions and metadata. For the SearchJack campaign, our scanner specifically identified extensions abusing the chrome_settings_overrides key in their manifest files to hijack user search settings.

Broker Infrastructure

The broker is identified by the hspart parameter in the final Yahoo redirect URL. The broker layer is the structural enabler of this campaign - individual extensions are disposable shells. The broker relationship, Yahoo partner account, and revenue infrastructure persist regardless of which extensions are active.

Full Extension Corpus

Search URLs & Broker Attribution

Notable Extensions

Nautilus Search - Affirmative False Privacy Claims

The store description states: "We don't track your searches, collect your personal information, or store any user data." The governing privacy policy (Kinner Lake Ltd.) explicitly discloses collection of IP addresses, search queries, and technical identifiers. These two statements cannot both be true. This is not a disclosure omission - it is an affirmative false claim in the store listing, potentially actionable under GDPR and FTC frameworks.

Search Toggler - Runtime Obfuscation

Unlike other extensions in this corpus, Search Toggler implements a genuine search engine switching UI. However, all queries are routed through searchtoggler[.]com/ext/search regardless of which engine the user selects - the operator middleware is always present in the chain. The routing logic is injected at runtime via chrome.declarativeNetRequest.updateDynamicRules() in background.js and is not present in the static extension package. The static redirect-rules.json contains only a rule matching srcorg=orgdefaulttest → google[.]com, which would only trigger in a controlled test environment. The real behavior is invisible to static analysis. Additionally, three disconnected corporate identities are associated with this extension: searchtoggler[.]com (extension domain), VPP Technologies LLC (privacy policy entity), and worthathousandwords[.]com (contact email domain).

Fusebase Search - Anomalous Review Ratio

Published by Nimbus Web Inc (legitimate company, FuseBase / Nimbus Screenshot), this extension shows 609 reviews against 490 current installs - a ratio of 1.24 that is not achievable organically. This suggests review manipulation, a CWS-triggered install count reset, or extension repurposing following a policy violation. The combination of a legitimate publisher identity and search monetization behavior warrants direct outreach to Nimbus Web Inc to confirm whether this extension remains under their control.

Earth 3D - Anonymous Publisher, Fictional Corporate Identity

Published under edgarlife1980[@]gmail[.]com. The privacy policy names "Mutual Media DBA Innosoft Group, Houston TX" - an entity with no verifiable connection to the publisher account. System1/infospace profits from this traffic while publisher accountability is effectively zero.

Campaign Patterns

Shell pattern - The majority of extensions are manifest-only wrappers: chrome_settings_overrides with is_default: true, no permissions, no background script, no content scripts. Same skeleton across multiple extensions, different domain and icon.

Trojan horse pattern - A subset invests in a superficial advertised feature (satellite imagery, maps, video library) to justify installation. The feature may be partially implemented to pass store review but is not the business purpose.

Admin path pattern - System1-affiliated extensions consistently route through /admin/public/link endpoints: earth3d[.]net, earthapp[.]net, loginonlineapp[.]com. Shared backend infrastructure template across the infospace broker network.

Publisher anonymization - Brokers do not brand their extensions. The only place operator identity surfaces is the hspart parameter in the Yahoo redirect URL - invisible to ordinary users.

Summary

SearchJack is a structured campaign of 23 deceptive Chrome browser extensions silently routing approximately ~758,000 users' search queries through operator-controlled monetization middleware. The campaign spans at least 8 distinct affiliate brokers and 22 publishers across multiple jurisdictions. The common enabling infrastructure - Yahoo Hosted Search and equivalent affiliate programs - imposes insufficient publisher vetting, allowing anonymous operators to monetize user search behavior at scale. Individual extension removal is insufficient; enforcement action at the broker level is required to disrupt the underlying monetization infrastructure.

Threat Impact

Why does this matter? While this might look like simple adware, it is a real security risk. First, it is a massive privacy violation: every search a user makes is sent to anonymous third-party brokers. Second, because the operators control the web traffic, they can easily switch from showing regular search results to injecting phishing links or malicious downloads at any time—all without ever updating the extension code itself.

*Research by Jean-Marie R. (Toborrm9) | Malicious Extension Sentry Project | June 09, 2026*