Cyble researchers uncovered Chrome extensions that hijack browsers and redirect user searches for monetary gain, affecting over two million users. The extensions modify default search engines, open persistent tabs, and route traffic through multiple redirects to collect data and serve ads, with ties to a STOPPROPAGANDA campaign and potential Russian government site redirects.
Keypoints
- CRIL identified three Chromium-based browser hijacker plugins active on the Chrome Web Store that impacted over 2 million users.
- Hijacker Plugin 1: WebSecurerr Browser Protection alters search behavior, blocks reversions to default settings, and redirects queries through go.searchsecurer[.]com to Yahoo; it also loads a JSON domain list that may flag legitimate sites.
- The code suggests a STOPPROPAGANDA linkage, with a route to a Russian government site when a flagged URL is clicked, though the warning-code path may be nonfunctional.
- Hijacker Plugin 2: UltraSurf Security, Privacy & Unblock VPN changes the default search to smartwebfinder[.]com, relies on proxy APIs, and opens ultrasurfing[.]com while performing ad-related activity; it has over 800K installs.
- This extension’s manifest and network activity show use of webRequest, storage, and proxy APIs and that searches ultimately land on Bing after multiple redirects, delaying results.
- Hijacker Plugin 3: Internet-Start redirects searches to internet-start[.]net, claims ad-blocking but displays ads; it collects user data for targeted advertising and uses Yandex Metrics and AdSense.
- Common themes include data collection for ads, traffic redirection, and persistent modifications to search behavior across Chrome/Chromium browsers.
- Our recommendations emphasize source verification, avoiding default settings reversion, and removing malicious extensions via browser settings or a reputable antivirus solution.
MITRE Techniques
- [T1090] Proxy – The extension uses the chrome.proxy API to route and manipulate traffic, including multiple redirects and search query handling. Quote: ‘This extension requires following the browser’s permission to access chrome’s built-in APIs: webRequest, storage, proxy’
Indicators of Compromise
- [Domain] go.searchsecurer[.]com, [Domain] searchsecurer[.]com – domains involved in redirecting search queries
- [Domain] smartwebfinder[.]com – domain used for altered search results
- [Domain] ultrasurfing[.]com – domain opened by the UltraSurf plugin
- [Domain] internet-start[.]net – domain used by the Internet-Start plugin
Read more: https://blog.cyble.com/2022/11/22/over-2-million-users-affected-with-browser-hijackers/