SearchJack: How 23 Browser Extensions Silently Monetize ~758,000 Users' Searches
">
2026-06-09<br>Adware tracking Search Hijacking
SearchJack: How 23 Browser Extensions Silently Monetize ~758,000 Users' Searches
Campaign Overview
FieldValue<br>Campaign NameSearchJack<br>Extensions Identified23<br>Unique Publishers22<br>Total Affected Users~758,000<br>Brokers Identified8<br>Primary MonetizationHosted Search Affiliate (Yahoo, multi-network)<br>Date of AnalysisJune 09, 2026
SearchJack is a campaign of 23 deceptive Chrome browser extensions that silently override users' default search engines and route queries through monetization middleware before delivering results. Each extension presents a different advertised purpose - satellite imagery, productivity tools, news readers, maps - while the actual business is search affiliate revenue. The campaign spans at least 8 distinct monetization brokers and ~758,000 affected users.
Data for this report was collected using the MalExt Sentry automated scanner. We continuously monitor browser extension stores and flag suspicious items based on specific keywords in their descriptions and metadata. For the SearchJack campaign, our scanner specifically identified extensions abusing the chrome_settings_overrides key in their manifest files to hijack user search settings.
Broker Infrastructure
The broker is identified by the hspart parameter in the final Yahoo redirect URL. The broker layer is the structural enabler of this campaign - individual extensions are disposable shells. The broker relationship, Yahoo partner account, and revenue infrastructure persist regardless of which extensions are active.
hspartBrokerExtensionsEst. Installs<br>trpUnknown3~160K<br>infospaceSystem1 (public)6~117K<br>flowsurfUnknown1100K<br>adkUnknown1100K<br>-Unknown6~178K<br>becoviBecovi Ltd, Dublin130K<br>imageadvanUnknown110K<br>mnetUnknown13K<br>fcUnknown12K<br>dcolaUnknown1490
Full Extension Corpus
Extension IDNamePublisherInstallsRatingFirst PublishedLast Updated<br>hohedjmdoemgcpgdapepfhnilbedldnmPerfecTab SearchKinner Lake Ltd.100K4.5 (4)2024-09-182024-09-18<br>keadechokmcohlcampccppbjjeabghcdQuick Search Toolquicksearchtool[.]com100K5 (2)2021-09-292024-04-02<br>epdmngmgidehpmhjamdjcaecpligmcfhBetter SearchBetter Search100K4.3 (350)2024-11-072026-03-20<br>pookachmhghnpgjhebhilcidgdphdlhiNewTab. SearchBonjour70K4.5 (83)2018-07-112024-12-18<br>flcaigefphghbcgbmfngbfdgipdflfpnNautilus Searchnautilusnotesapp50K-2025-01-312025-01-31<br>hnfdneofpohlkoeljnmkdocokcdkjiaaEarthEarth50K1 (1)2025-03-292026-01-23<br>bgliakflmjnofiolfmnbncdmgfnibgnjWanderlustarWanderlustar50K5 (1)2022-11-042024-10-28<br>cnkcgoiimpncbonlilkekbigfhchcbgbTemplate SearchTemplate Search50K2.3 (3)2023-03-282025-02-02<br>kbobdmmjbaljcombpliahadgoafgohcdEarth 3DEarth 3D40K1 (2)2025-07-122025-07-12<br>eeejfmalgedffijdepcdmgemfnadjefeMy Focal Findreedd686840K1 (1)2021-07-162024-05-23<br>mccmkaicbneobeclkbloeoopcfeipmioGreat Startgreatstartlab30K-2024-09-182024-09-18<br>jeookppofphgjnhjkifeejcmjbpiogkaFresh Fruit Searchwallacenathan33010K1 (1)2021-05-232024-05-28<br>ijbmkpeacbkgpfkomjbionjgdhbmlpfpView Menu with PricesMenuswithPrices10K-2026-01-292026-01-29<br>hodgcolihbmeagfcfpdfpnapfflmpbkbSearch Toggler-10K-2025-05-212025-05-21<br>cpmjnpalighpdecgankobogpcmbceaigEasy LoginEasy Login10K2.5 (2)2025-07-082025-08-21<br>akimdaijebpdfojiohhimbebkdigkccjSearchThatWebsearchthatweb.extension10K4.9 (31)2023-06-222024-05-30<br>oikgbpcmdphfkhplgkfngjilemlolannFreshy SearchFreshy10K3.5 (2)2022-01-282024-06-12<br>efakcomgmimcekdejnoafmmbgnpdhdfmVideo Search ExtensionAlice Carrol6K3.3 (3)2020-11-042025-10-09<br>gmapdckphdmbafmmcfoahhgoogdjeellGet Maps & Driving DirectionsQwerPDF5K3.7 (3)2022-10-202025-04-23<br>odafhekandnacimkenmaagnoemnpaakkSearch AnythingSearch Anything3K3.7 (3)2023-05-092024-03-14<br>jgoihmjphghpnjedflgemmhjdaogimadSatelliten Earthdy1[.]com2K-2025-04-262025-05-15<br>dllhnjhfilgcjopkgdekmdmfilpfceigSurfer Searchsurfersearchext2K4.6 (5)2025-04-102025-07-31<br>ododhdcefemfdbnidbeipjpjaehadjenFusebase SearchNimbus Web Inc4904.2 (609)2013-12-212026-01-08
Search URLs & Broker Attribution
Extension IDNameSearch URLhsparthsimp<br>hohedjmdoemgcpgdapepfhnilbedldnmPerfecTab Searchhxxps://myperfecttab[.]com/search/?q={searchTerms}flowsurfyhs-perfecttab2<br>keadechokmcohlcampccppbjjeabghcdQuick Search Toolhxxps://query.quicksearchtool[.]com/s?query={searchTerms}adkyhs-adk_sbnt<br>epdmngmgidehpmhjamdjcaecpligmcfhBetter Searchhxxps://search.getbettersearch-api[.]com/search/{searchTerms}trpyhs-001<br>pookachmhghnpgjhebhilcidgdphdlhiNewTab. Searchhxxps://newtab[.]club/search?q={searchTerms}--<br>flcaigefphghbcgbmfngbfdgipdflfpnNautilus Searchhxxps://nautilus-notes[.]com/search?q={searchTerms}--<br>hnfdneofpohlkoeljnmkdocokcdkjiaaEarthhxxps://earthapp[.]net/admin/public/link?q={searchTerms}infospaceyhs-earth<br>bgliakflmjnofiolfmnbncdmgfnibgnjWanderlustarhxxps://wanderlustar[.]com/k?source=7023.139&kw={searchTerms}--<br>cnkcgoiimpncbonlilkekbigfhchcbgbTemplate...