SearchJack 23 Chrome Extensions Silently Monetize ~758,000 U...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://malext.io/reports/SearchJack
• Blog Title: SearchJack: 23 Chrome Extensions Silently Monetize ~758,000 Users' Searches
• Suggested Section: Pentesting Web > Browser Extension Pentesting Methodology

🎯 Content Summary

SearchJack campaign overview

SearchJack is a campaign of 23 deceptive Chrome browser extensions affecting approximately 758,000 users. The extensions advertise unrelated utilities such as satellite imagery, maps, productivity tools, news readers, video libraries, menu-price lookup, or new-tab/search helpers, but their shared business logic is search hijacking for affiliate monetization.

The campaign was identified by the MalExt Sentry automated sca...

🔧 Technical Details

Default search hijacking via Chrome extension manifests: A deceptive Chrome extension can abuse the legitimate chrome_settings_overrides manifest key to replace the browser's default search provider. By setting the custom provider as default with is_default: true and embedding {searchTerms} in a URL such as hxxps://example[.]com/search?q={searchTerms}, the extension causes all omnibox searches to be sent to an attacker- or operator-controlled endpoint. This can be done with no background script, no content script, and few or no extra permissions, making static permission-based review ineffective.

Affiliate search laundering and infrastructure attribution: Search hijackers can forward captured queries through intermediate middleware and then redirect users to Yahoo Hosted Search or another affiliate search network. Parameters such as hspart and hsimp can reveal broker or campaign identit...

🤖 Agent Actions

Done.

Updated:

• src/pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.md

Added:

• chrome_settings_overrides.search_provider omnibox hijacking
• manifest-only shell detection
• affiliate redirect attribution via hspart / hsimp
• clustering via shared backend paths like /admin/public/link and serp.php
• runtime chrome.declarativeNetRequest.updateDynamicRules() review guidance
• references to the MalExt report and official Chrome docs

Validation:

• git diff --check passed
• mdbook build could not be run because mdbook is not installed in this environment

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://malext.io/reports/SearchJack

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > Browser Extension Pentesting Methodology".

Repository Maintenance:

• MD Files Formatting: 977 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0