Predator Search

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

The manifest‑level description “Change the default omnibox (address bar) search to Predator Search.” matches the observed behavior in the code. In bgrd.js:8 a fetch call is recorded, confirming that the extension contacts an external server at runtime. The same file is responsible for building URLs such as https://predatorwallpaper.com/search?q= and https://predatorwallpaper.com/start?session=$, which are listed in the XIOC findings XIOC-URL-https://predatorwallpaper.com/search?q=, XIOC-URL-https://predatorwallpaper.com/start?session=$ and XIOC-URL-https://predatorwallpaper.com/uninstall?session=$. These endpoints belong to the domain predatorwallpaper.com, identified in multiple XIOC entries (XIOC-DOMAIN-predatorwallpaper.com). The presence of these URLs demonstrates that the extension replaces the user’s default search engine with a third‑party service that the publisher controls.

The extension also attempts to download additional resources from the same domain, as shown by the network‑level fetch in bgrd.js and the URL https://predatorwallpaper.com/favicon.ico. This pattern of loading assets from a remote server is characteristic of browser‑hijacking extensions that can later change the content displayed on new‑tab pages or inject advertisements.

A YARA match titled YARA--postinstall_crypto_operations was reported in the file /metadata/verified_contents.json. According to CVEQ’s known‑false‑positive rules, any rule prefixed with postinstall_ is a generic code‑smell detection and should not be treated as a malware signature. Consequently, there is no concrete evidence of malicious payloads beyond the hijacking behavior.

Additional IoC entries reference benign infrastructure such as clients2.google.com, www.inkscape.org, and the generic pattern rule.id. These are typical of legitimate update mechanisms and library resources and do not affect the risk assessment.

The extension is published by the email address [email protected], with no recognized brand affiliation. The name Predator Search does not imitate a well‑known competitor, so impersonation is not a factor. The primary risk stems from the unsolicited modification of the user’s search experience and the potential for further content injection from the remote domain.

A skeptic might argue that the remote URLs could be used for legitimate personalization or that the YARA detection indicates hidden cryptographic activity. However, the explicit manifest statement to alter the omnibox combined with the hard‑coded calls to predatorwallpaper.com demonstrates an intentional redirection of search queries, which is a classic browser‑hijack technique. The YARA rule is a known false positive and does not outweigh the concrete evidence of search hijacking.

In summary, the extension’s behavior aligns with a browser‑hijacking profile: it changes the default search engine, contacts a non‑trusted domain, and loads remote assets without user consent. Users should be aware that installing this extension will redirect their searches and expose their browsing to the third‑party site.

Key Reasons

• Manifest declares omnibox redirection to Predator Search
• bgrd.js fetches URLs on predatorwallpaper.com
• Multiple XIOC entries show connections to predatorwallpaper.com
• YARA postinstall rule is a known false positive
• No legitimate brand or impersonation detected

False Positive Considerations

• postinstall_* YARA rule
• generic CDN domains in IoC list
• code‑smell findings not listed
• bundled dependency noise

Reviewed 2026-05-23; recommended action: monitor; model confidence 82%.