Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by socket.dev
Incognito Search Helper
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 5 days ago
- Version
- v1.0.3
- Artifact
- SHA256 8E2…BD3
- Source
- Findings (non-IoC)
Is Incognito Search Helper safe?
Private Search Helper declares one sensitive permission, tabs, which lets it read the title and address of every open tab. Its code reaches three domains: searchtools.app for search and suggestion requests, plus system1.com and ns.attribution.com.
The searchtools.app calls handle the visible work. Queries go to https://searchtools.app/api/search with an app=private parameter attached, and keystroke suggestions come from https://searchtools.app/api/suggest?q=. System1 sells search monetization to extension developers, and the bundle embeds links to https://system1.com/terms/terms-of-use and its privacy policy next to a call to http://ns.attribution.com/ads/1.0/. A finding titled MANIFEST-SENSITIVE-PERM-TABS flags that tabs access in manifest.json. Tab visibility plus ad-attribution endpoints gives the publisher a way to see browsing activity and bill partners for search traffic.
The scanner also logged entries such as e.target.select, a property access inside minified JavaScript rather than a real host, and those entries inflate the total without describing anything the extension does. The details worth your attention are the System1 paperwork, the attribution call, and a name promising private search while the plumbing points toward ad revenue.
No malware signature or obfuscation finding turned up, so nothing here reads as a hidden payload. The concern comes from a small extension with no users, an anonymous Gmail address standing in for a developer name, and monetization partners its description never mentions.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
4 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall crypto operations | 1 | _metadata/verified_contents.json | - |
| LOW | postinstall file manipulation | 1 | background.js | - |
| LOW | postinstall obfuscation | 2 | js/popup.jsbackground.js | - |
| LOW | postinstall system command | 3 | README.mdpopup.htmlincognito-required.html | - |
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
13 evidence rows available.
Finding Categories
YARA Rules Matched
4 rules(7 hits)Requested Permissions
3 permissionsAI Security Report
AI Security Review
Evidence context: threat category browser hijack; evidence quality moderate.
Private Search Helper (version 1.0.2, published under [email protected]) describes itself as an "enhanced search experience with private search capabilities." The code tells a different story about who profits from that experience.
The extension talks to three hosts: searchtools.app, system1.com and ns.attribution.com. The searchtools.app endpoints carry the visible function. https://searchtools.app/api/suggest?q= returns keystroke suggestions, https://searchtools.app/api/search runs the query, and one variant appends &app=private to the same API call. That parameter travels with every search and lets the server tag traffic as coming from this build.
The other two hosts belong to the ad side of the business. System1 sells search monetization to extension developers and pays out on the traffic they send. The bundle embeds https://system1.com/terms/terms-of-use and https://system1.com/terms/privacy-policy directly, so System1's contract text ships inside the extension itself. A call to http://ns.attribution.com/ads/1.0/ sits alongside those links, over plain HTTP, and attribution endpoints exist to record conversions.
manifest.json triggers a finding titled MANIFEST-SENSITIVE-PERM-TABS for the tabs permission. Tab access exposes every open tab's title and address. Pair that with an attribution pixel and the publisher can tie browsing activity to ad performance for a given user.
What the scan did not find matters too. No malware signature, no obfuscation, no eval, no remote code loader. The seven code-smell results at low severity come from bundled JavaScript and say nothing about intent. The IoC list also carries junk. XIOC-DOMAIN-e.target.select is a property chain lifted out of minified code, not a host,
and https://searchtools.app/api/search'; picked up a stray quote from the source. The count of thirteen indicators means little on its own; the specific hosts do.
A skeptic could argue that suggestion APIs are ordinary plumbing, that System1 is a public company with real contracts, and that monetizing search traffic breaks no rule. That argument holds for the two searchtools.app endpoints. It strains against the rest of the package: a description promising private search, no mention of a monetization partner anywhere in the public copy, a Gmail address instead of a developer identity, zero users, and an attribution call in the same codebase that runs the searches. That combination is the standard shape of a search-monetizing extension.
The missing piece is a chrome_settings_overrides block or an explicit default-search swap, which the evidence does not show. Without it we can document the monetization plumbing and the tab access, and we cannot yet show the omnibox takeover. Runtime analysis that installs the extension and types a query would settle whether searchtools.app becomes the default provider.
Key Reasons
- Bundle embeds https://system1.com/terms/terms-of-use and https://system1.com/terms/privacy-policy, tying the extension to System1's search monetization program
- Call to http://ns.attribution.com/ads/1.0/ ships alongside the search API calls, indicating ad conversion tracking
- Description promises 'private search' while searchtools.app API requests append app=private and route queries through a third-party server
- MANIFEST-SENSITIVE-PERM-TABS flags the tabs permission in manifest.json, exposing tab titles and URLs to a publisher with ad partners
- Zero users, version 1.0.2, and a Gmail address as the developer name for an extension presenting itself as a privacy tool
False Positive Considerations
- XIOC-DOMAIN-e.target.select is a property-access chain from minified JS, not a resolvable host
- Seven low-severity code-smell findings reflect bundled JavaScript patterns, not malicious logic
- https://searchtools.app/api/search'; is a string fragment with a stray quote, not a distinct endpoint
- Malformed URLs missing scheme prefixes (https://searchtools.app/*) add noise without new information
Reviewed 2026-10-18; recommended action: monitor; model confidence 70%.
Chrome version history
Risk trend by version
3 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.