← Campaigns
trackingnumbers.org
The USPS Tracking extension silently sets default search to trackingnumbers.org and sends install pings, affecting ~50,000 Chrome users.
- Extensions
- 4
- Stores
- Chrome, Firefox
- Updated
- 2026-10-26
- Disclosed
- 2026-08-03
- Last observed
- 2026-10-08
Member extensions
4 extensions| Extension | Store | Reported versions | Current risk |
|---|---|---|---|
| USPS Trackingnjincahdjloohmjeonojgjeihkgbjfko | Chrome | Not specified | Unscored |
| Security Insights : Phishing Protectionjjeiigladejdekjcgpkoafadnhpobjbb | Chrome | 1.1.157 | 31.18LOW |
| dxblock@notdxbidxblock@notdxbi | Firefox | 1.2.0 | 64.99MEDIUM |
| ScamsShieldmceocgganalljahkbbfhogjcafgokoop | Chrome | 1.49.8 | 77.66HIGH |
Indicators
Download STIX →Browse 8 indicators
| Type | Value & evidence |
|---|---|
| sha256 | d4be0f65c9472ee4bc05794e8e895ce596249479091c45fe5f9d0798220b0d1cfull CRX, analysed build archived in R2 (ScamsShield 1.49.8) |
| sha256 | be0751472e717014935686bf180a694122aaf3a0bfa311dea1dd058b621d701afull CRX, analysed build archived in R2 (Security Insights : Phishing Protection 1.1.157) |
| sha256 | b8b081d7f3de8f5c0fb50834f09648cc5d3c8a552cbf6914d75b2c2196d1c159full CRX, analysed build archived in R2 ( 1.2.0) |
| domain | trackingnumbers.orgSearch hijack target and ping receiver |
| url | https://trackingnumbers.org/admin/public/installInstallation ping endpoint |
| url | https://trackingnumbers.org/admin/public/pixelsPixel/beacon endpoint |
| url | https://trackingnumbers.org/admin/public/link?q={searchTerms}Search override URL template |
| url | https://trackingnumbers.org/success-searchSuccess page opened on install |