SimplyFound

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

The SimplyFound extension exhibits clear browser hijacking behavior. The extension description states it "Enhances your search with intelligent redirection and comprehensive analytics tracking" — the phrase "intelligent redirection" is a hallmark of search hijacking extensions that redirect queries to monetized search engines. The developer email "[email protected]" indicates an ad-network publisher rather than a legitimate software company.

The most significant finding is the IoC "XIOC-URL-https://www.blpsearch.com/search*" which reveals a custom search engine domain. This is a definitive browser hijacking pattern — legitimate search extensions use established search providers (Google, Bing, DuckDuckGo), not proprietary domains. The additional finding "XIOC-URL-https://blpsearch.com/uninstall/" shows an uninstall page hosted on this same domain, a common tactic to make removal difficult.

The network finding in "background-service-worker.js:779" confirms fetch calls are being made, consistent with the analytics tracking mentioned in the description. The domain "expldata.com" appears in the IoC findings, which likely handles data exfiltration for the analytics component.

The majority of the 61 IoC findings are false positives from the XIOC extractor. Property access chains like "chrome.runtime.id", "this.userparams.tg", "this.userparams.pub", and "cookie.name" are JavaScript object properties misread as domains. The "pki.goog" and "c2pa-ocsp.pki.goog" URLs are legitimate Google certificate infrastructure. The 18 code-smell findings are low-severity YARA matches that fire on basic JavaScript patterns.

Counterargument: A skeptic might argue that with zero malware signatures, zero obfuscation findings, and only 3 users, this extension poses minimal threat. However, browser hijackers are not malware in the traditional sense — they are legitimate software with aggressive monetization behavior. The absence of malware signatures does not make browser hijacking benign. The combination of custom search domain, analytics tracking, ad-network developer email, and "redirection" in the description constitutes sufficient evidence of intentional browser hijacking regardless of user count or malware signature presence.

This extension should be classified as a confirmed risk due to its search hijacking functionality and data collection practices.

Key Reasons

• Custom search domain blpsearch.com detected in IoC findings
• Extension description mentions intelligent redirection and analytics tracking
• Developer email from ad-network domain (explorads.com)
• Network fetch calls in background-service-worker.js:779
• Uninstall page hosted on hijacker domain

False Positive Considerations

• Property access chains misread as domains (chrome.runtime.id, this.userparams.tg, cookie.name)
• Google infrastructure domains (pki.goog, c2pa-ocsp.pki.goog)
• Low-severity code-smell YARA findings (18 total)
• XIOC extractor false positives in extracted_from_files

Reviewed 2026-04-28; recommended action: monitor; model confidence 82%.