Active8 Search Engine Takeover and Affiliate Redirect

Overview

Active8 (Chrome Web Store ID: amelaaifnhgegallekdnnfndlilhhmde) is a malicious search hijacker. It silently overrides the user's default search engine with its own provider, "Active8 Search," pointing to y.activate-tab.com. The store description ("Empower each session with the the worlds best sports imagery!") gives no indication of this behavior. RiskyPlugins' MINIMAL rating for this extension is incorrect for the current 1.0.4 build; MalExt labels this as search hijacking.

How it works

The extension's manifest.json (line 3) includes a chrome_settings_overrides block that sets search_provider to Active8 Search with search_url https://y.activate-tab.com/search?q={searchTerms}. Sandbox observation (dynamic:1) confirms that at runtime the extension programmatically sets the search provider to this URL without user interaction. When a query is sent to y.activate-tab.com, the server responds with an HTTP redirect to https://search.yahoo.com/yhs/search?hspart=syndic8&hsimp=yhs-active8&p=testquery&type=sourceAUD9999. The parameters hspart=syndic8, hsimp=yhs-active8, and type=sourceAUD9999 indicate an affiliate/syndication arrangement, meaning the extension operator earns revenue for each search performed through this route.

Payload

The payload is a search engine takeover. All user searches are routed through an intermediary domain controlled by the operator, then to Yahoo with affiliate tags. This monetizes user searches without explicit consent. Additionally, the operator's server (y.activate-tab.com) receives every search query, exposing potentially sensitive search terms to a third party.

Store status

Active8 remains available on the Chrome Web Store with 100,000+ installs. The store listing does not disclose the search engine change or the affiliate redirection. The extension has been flagged by MalExt's search hijacking report as malicious.

Data gaps: The exact manifest line could not be fully re-read to confirm is_default: true versus a prompt, but the sandbox observation shows the provider set without user action. First-party hosts like g.activate-tab.com were seen in newtab.js but their request payloads were not decoded.