A featured Chrome extension “Planet Search” (2M installs) routes every query to the nextgeeker[.]com hijacker network

While analyzing featured extensions on our beloved chrome web store I landed on Planet Search (kadaohckdkghfaclhjmkmplebcdcnfnp), Featured, 2M users, publisher FREE VPN PLANET SRL. The extensions has a 0-byte background.js with zero permissions. The whole mechanism is one chrome_settings_overrides search provider, so nothing shows up statically. It’s all server-side. Declared provider is planet-search[.]com. Tracing: planet-search[.]com/search/?q= 301 → sstmaster[.]com/edge/PN1021?q= 302 → nextgeeker[.]com/B151001.php?q=&src=PN1021 nextgeeker[.]com is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others). PN1021 is the affiliate subid linking the extension’s traffic to that network. The listing discloses none of the hops and says only that results come from Google (the final page is a Google CSE render). Same publisher ships a ~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have. Report: https://malext.io/reports/RoguePlanet/ submitted by /u/Huge-Skirt-6990 [link] [comments]Technical Information Security Content & DiscussionRead More