SearchJack

OmniSearch changes the default search engine to defaultsearch.co and sends install ID, timestamps, and browser data to Lavasoft servers, impacting approximately 80,000 users.

Extensions: 1
Stores: Chrome
Updated: 2026-10-03
Disclosed: 2026-06-28
Last observed: 2026-10-03

Member extensions

1 extension

Campaign member extensions and their current risk
Extension	Store	Reported versions	Current risk
OmniSearchdjgflnccplcmifemnpgnkkdblihncpmm	Chrome	Not specified	46.99MEDIUM

Indicators

Download STIX →

Browse 5 indicators

Type	Value & evidence
domain	defaultsearch.coSearch provider domain used in chrome_settings_overrides
url	https://defaultsearch.co/?sp=11&q={searchTerms}Search URL template set as default
domain	flow.lavasoft.comTelemetry endpoint receiving event stat data
url	https://mynewtab.co/omnibox/uninstall.html?Uninstall tracking URL set by the extension
id	djgflnccplcmifemnpgnkkdblihncpmmChrome Web Store extension ID

Research & sources

Read the investigation →

https://malext.io/reports/SearchJack/