The "SearchJack" campaign involves 23 deceptive Chrome extensions that hijack user search settings via the `chrome_settings_overrides` manifest key, silently routing queries through affiliate monetization brokers before delivering results from Yahoo. The campaign affects approximately 758,000 users and is enabled by at least eight distinct broker infrastructures. Organizations should audit installed extensions against the provided list and consider implementing automated scanning for similar manifest abuses.
2026-06-09 Adware tracking Search Hijacking SearchJack: How 23 Browser Extensions Silently Monetize ~758,000 Users' Searches Campaign Overview Field Value Campaign Name SearchJack Extensions Identified 23 Unique Publishers 22 Total Affected Users ~758,000 Brokers Identified 8 Primary Monetization Hosted Search Affiliate (Yahoo, multi-network) Date of Analysis June 09, 2026 SearchJack is a campaign of 23 deceptive Chrome browser extensions that silently override users' default search engines and route queries through monetization middleware before delivering results. Each extension presents a different advertised purpose - satellite imagery, productivity tools, news readers, maps - while the actual business is search affiliate revenue. The campaign spans at least 8 distinct monetization brokers and ~758,000 affected users. Data for this report was collected using the MalExt Sentry automated scanner. We continuously monitor browser extension stores and flag suspicious items based on specific keywords in their descriptions and metadata. For the SearchJack campaign, our scanner specifically identified extensions abusing the chrome_settings_overrides key in their manifest files to hijack user search settings. Broker Infrastructure The broker is identified by the hspart parameter in the final Yahoo redirect URL. The broker layer is the structural enabler of this campaign - individual extensions are disposable shells. The broker relationship, Yahoo partner account, and revenue infrastructure persist regardless of which extensions are active. hspart Broker Extensions Est. Installs trp Unknown 3 ~160K infospace System1 (public) 6 ~117K flowsurf Unknown 1 100K adk Unknown 1 100K - Unknown 6 ~178K becovi Becovi Ltd, Dublin 1 30K imageadvan Unknown 1 10K mnet Unknown 1 3K fc Unknown 1 2K dcola Unknown 1 490 Full Extension Corpus Extension ID Name Publisher Installs Rating First Published Last Updated hohedjmdoemgcpgdapepfhnilbedldnm PerfecTab Search Kinner Lake Ltd. 100K 4.5 (4) 2024-09-18 2024-09-18 keadechokmcohlcampccppbjjeabghcd Quick Search Tool quicksearchtool[.]com 100K 5 (2) 2021-09-29 2024-04-02 epdmngmgidehpmhjamdjcaecpligmcfh Better Search Better Search 100K 4.3 (350) 2024-11-07 2026-03-20 pookachmhghnpgjhebhilcidgdphdlhi NewTab. Search Bonjour 70K 4.5 (83) 2018-07-11 2024-12-18 flcaigefphghbcgbmfngbfdgipdflfpn Nautilus Search nautilusnotesapp 50K - 2025-01-31 2025-01-31 hnfdneofpohlkoeljnmkdocokcdkjiaa Earth Earth 50K 1 (1) 2025-03-29 2026-01-23 bgliakflmjnofiolfmnbncdmgfnibgnj Wanderlustar Wanderlustar 50K 5 (1) 2022-11-04 2024-10-28 cnkcgoiimpncbonlilkekbigfhchcbgb Template Search Template Search 50K 2.3 (3) 2023-03-28 2025-02-02 kbobdmmjbaljcombpliahadgoafgohcd Earth 3D Earth 3D 40K 1 (2) 2025-07-12 2025-07-12 eeejfmalgedffijdepcdmgemfnadjefe My Focal Find reedd6868 40K 1 (1) 2021-07-16 2024-05-23 mccmkaicbneobeclkbloeoopcfeipmio Great Start greatstartlab 30K - 2024-09-18 2024-09-18 jeookppofphgjnhjkifeejcmjbpiogka Fresh Fruit Search wallacenathan330 10K 1 (1) 2021-05-23 2024-05-28 ijbmkpeacbkgpfkomjbionjgdhbmlpfp View Menu with Prices MenuswithPrices 10K - 2026-01-29 2026-01-29 hodgcolihbmeagfcfpdfpnapfflmpbkb Search Toggler - 10K - 2025-05-21 2025-05-21 cpmjnpalighpdecgankobogpcmbceaig Easy Login Easy Login 10K 2.5 (2) 2025-07-08 2025-08-21 akimdaijebpdfojiohhimbebkdigkccj SearchThatWeb searchthatweb.extension 10K 4.9 (31) 2023-06-22 2024-05-30 oikgbpcmdphfkhplgkfngjilemlolann Freshy Search Freshy 10K 3.5 (2) 2022-01-28 2024-06-12 efakcomgmimcekdejnoafmmbgnpdhdfm Video Search Extension Alice Carrol 6K 3.3 (3) 2020-11-04 2025-10-09 gmapdckphdmbafmmcfoahhgoogdjeell Get Maps & Driving Directions QwerPDF 5K 3.7 (3) 2022-10-20 2025-04-23 odafhekandnacimkenmaagnoemnpaakk Search Anything Search Anything 3K 3.7 (3) 2023-05-09 2024-03-14 jgoihmjphghpnjedflgemmhjdaogimad Satelliten Earth dy1[.]com 2K - 2025-04-26 2025-05-15 dllhnjhfilgcjopkgdekmdmfilpfceig Surfer Search surfersearchext 2K 4.6 (5) 2025-04-10 2025-07-31 ododhdcefemfdbnidbeipjpjaehadjen Fusebase Search Nimbus Web Inc 490 4.2 (609) 2013-12-21 2026-01-08 Search URLs & Broker Attribution Extension ID Name Search URL hspart hsimp hohedjmdoemgcpgdapepfhnilbedldnm PerfecTab Search hxxps://myperfecttab[.]com/search/?q={searchTerms} flowsurf yhs-perfecttab2 keadechokmcohlcampccppbjjeabghcd Quick Search Tool hxxps://query.quicksearchtool[.]com/s?query={searchTerms} adk yhs-adk_sbnt epdmngmgidehpmhjamdjcaecpligmcfh Better Search hxxps://search.getbettersearch-api[.]com/search/{searchTerms} trp yhs-001 pookachmhghnpgjhebhilcidgdphdlhi NewTab. Search hxxps://newtab[.]club/search?q={searchTerms} - - flcaigefphghbcgbmfngbfdgipdflfpn Nautilus Search hxxps://nautilus-notes[.]com/search?q={searchTerms} - - hnfdneofpohlkoeljnmkdocokcdkjiaa Earth hxxps://earthapp[.]net/admin/public/link?q={searchTerms} infospace yhs-earth bgliakflmjnofiolfmnbncdmgfnibgnj Wanderlustar hxxps://wanderlustar[.]com/k?source=7023.139&kw={searchTerms} - - cnkcgoiimpncbonlilkekbigfhchcbgb Te...