NewTab. Search Chrome Extension Search Hijacking to Affiliate Redirect

Overview

NewTab. Search (Chrome extension ID: pookachmhghnpgjhebhilcidgdphdlhi) is a search hijacker. The build analyzed (v2.0.0.0) declares a chrome_settings_overrides entry in its manifest that sets newtab.club as the default search engine with is_default: true and no required permissions. Installing the extension silently replaces the user's default search provider.

How it works

The manifest contains the following lines:

"chrome_settings_overrides": {
  "search_provider": {
    "is_default": true,
    "search_url": "https://newtab.club/search?q={searchTerms}",
    "suggest_url": "https://newtab.club/search/suggest.php?q={searchTerms}"
  }
}

The sandbox confirmed that the extension sets search_provider to https://newtab.club/search?q={searchTerms} upon installation.

When a user performs a search from the omnibox, the query is sent to newtab.club/search. A live request to https://newtab.club/search?q=test returned an HTTP 200 redirect to https://nextgeeker.com/F121001.php?q=test&src=PN1005. The src=PN1005 parameter is an affiliate tag, indicating that searches are monetized through a third-party advertising network not disclosed on the extension's Chrome Web Store listing.

Payload

The extension ships no other logic or permissions. The permissions field is empty ([]). The extension's popup page (popup/main.html) is missing, causing a net::ERR_FILE_NOT_FOUND when opened. This strongly suggests the extension exists solely to hijack search traffic. There is no cookie stealing, form grabbing, or remote code execution. The only observable behavior is the search override.

Store status

The extension is currently listed on the Chrome Web Store with approximately 70,000 users. The verdict is based on the current build; no older versions were available to compare. The suggest_url endpoint was not tested for query leakage via autocomplete. Server-side logic at nextgeeker.com beyond the redirect was not retrieved.

Users who have installed this extension should remove it and reset their default search engine in Chrome settings (chrome://settings/search). No credential rotation is required based on the observed behavior, as the extension does not request permissions that allow access to sensitive data.