Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users

What it is

Socket's roster of 319 browser extensions (about 13.44M users) that monetize hijacked searches through Yahoo and Bing partner accounts. The fetched text is only the roster. It gives no mechanism, timeline or removal status. Operators are grouped by shared monetization IDs, so those IDs work as indicators.

Where the users are

• 200 extensions (~5.68M users) are tied to named operators. 119 (~7.76M users) are not.
• Intango LTD has the most named extensions: 111, ~2.19M users. 12 more Intango extension IDs were removed from the Chrome Web Store before Socket could record them.
• "SecuryBrowse" is the largest unknown cluster: 58 extensions, ~4.9M users.
• "Bing-Search" has 37 extensions, ~2.21M users, and is pushed through Bidbrain advertising networks.
• The single biggest extension is from Free Planet VPN S.R.L: 1 extension, 2M users.
• Perion Network (CodeFuel) runs a resale network. Publishers resell search traffic into Perion's Yahoo account (hspart=fc), each under its own sub-ID.
• System1 and Mutual Media are linked: individuals buy ads on System1's search feed under Mutual Media's mm_ partner codes on infospace.

What to do

Search proxy or DNS logs and browser history for these parameters on Yahoo and Bing search URLs. A match suggests a hijacking extension is installed.

Yahoo hspart values named on the page:

iba (Intango, acct 5056)    tro (Tightrope)     ssl (Capital Intellect)
blp, aztec (Aztec Media)    dcola (ValidClick, WEB MEDIA)   litmus (ValidClick)
sz (Digital Network Assoc., Intelligent Technologies)
sgp, infospace (System1, Mutual Media, Vimaok)
fc (Perion, Intelligent Technologies)   bc (Free Planet VPN)   flowsurf (Kinner Lake)

Bing PC= codes:

INES*  (Intango, 15 extensions)
3QCV, 3CGP  (SecuryBrowse; PTAG=1103, 1306, 1309)
3FPX, 3VSS  (Bing-Search; per-brand PTAG=13xx)
ARPL  (ARPL; PTAG=ZQ.2.1.N.N.2.B13xx/B14xx)

Other indicators from the page:

• Domains *.system1.partners and *.s1search.co (System1).
• The handler axt.iadispatcher.com with a=pc.typedin.<brand> (VPP Technologies).
• The aff_fcid parameter marks an AliExpress affiliate redirector (40,000 users). It earns shopping commissions, not search revenue.

Caveats

• The text does not say how the extensions intercept searches, whether they are still in the stores, or how to list the 319 extension IDs.
• Operator labels such as "SecuryBrowse", "Bing-Search", "HermesTab" and "ARPL" are Socket's names for unattributed clusters, not known companies.
• Several attributions are loose. BrightWorks/SilverEdge is grouped by Google Ads buyer, and its Get Weather Today runs on Intango's Yahoo account. Intelligent Technologies' Yahoo ID rotates per request.
• A shared hspart value does not by itself prove one operator. dcola appears under both WEB MEDIA (on ValidClick's partner account) and ValidClick, and sz appears under two operators.
• Perion's resold traffic and System1's feed both involve third parties.