Search Online

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

The extension 'Search Online' exhibits clear browser hijacking behavior. The description explicitly states it 'sets your default search setting to Online Search Tool with sponsored search results.' This is the defining characteristic of a browser hijacker—it modifies user settings to redirect search traffic for monetization purposes.

The IoC findings reveal the extension's infrastructure. The URL https://onlinesearchtool.org/hometab/ indicates new tab page replacement functionality. The endpoint https://onlinesearchtool.org/auto-suggest/search.php?q= handles search query redirection. The tracking endpoint https://onlinesearchtool.org/auto-suggest/track.php collects user search behavior data. The uninstall tracking at https://onlinesearchtool.org/auto-suggest/uninstall.php is a common PUP tactic to monitor retention rates.

Several IoC findings are false positives: :: is an IPv6 fragment from minified code, not a real IP address. The domains date.now, win.id, and cookie.name are property access chains misidentified by the XIOC extractor, not actual network destinations. Legitimate infrastructure domains like fonts.googleapis.com and clients2.google.com are benign.

The publisher identity raises significant concerns. The developer is listed only as [email protected]—an email address with no company name or brand attribution. This anonymous publisher combined with browser hijacking behavior is a well-documented red flag profile.

No malware signatures were detected, which is expected for browser hijackers. These are Potentially Unwanted Programs (PUPs) rather than traditional malware. The 10 code-smell findings are classified as low severity and represent noise from basic JavaScript patterns, not malicious code.

Counterargument: One might argue this is a legitimate search tool offering sponsored results. However, the description itself admits to 'sets your default search setting'—legitimate search extensions don't modify browser defaults without explicit user consent. The combination of anonymous publishing, search redirection, tracking endpoints, and home tab replacement constitutes intentional hijacking behavior, not a legitimate utility.

Key Reasons

• Description explicitly states extension sets default search settings to sponsored results
• Domain onlinesearchtool.org used for search redirection, tracking, and home tab replacement
• Anonymous publisher with email-only attribution
• No malware signatures but clear PUP/browser hijacker behavior patterns

False Positive Considerations

• IPv6 fragment '::' from minified JavaScript
• Property access chains misread as domains: date.now, win.id, cookie.name
• Code-smell findings from basic JavaScript patterns
• Legitimate CDN domains: fonts.googleapis.com, clients2.google.com

Reviewed 2026-05-23; recommended action: monitor; model confidence 85%.