Predator Search: Persistent Search Hijacking with Session Tracking

Overview

Predator Search is a Chrome extension that replaces the browser's default omnibox search with predatorwallpaper.com and attaches a persistent 32-character session identifier to every search request made through that provider. The session ID is also reported to the operator on startup and on uninstall, allowing the operator to link a user's search queries across sessions and devices. The extension does not steal credentials or exfiltrate browsing history; its risk lies in the undisclosed tracking and the redirection of all address-bar searches to an operator-controlled server.

How it works

On installation, the extension's background script (bgrd.js) generates a random 32-character session string:

session = [...Array(32)].map(() => (~~(Math.random() * 36)).toString(36)).join('');

It then sends this session ID to the operator's /start endpoint:

fetch(`https://predatorwallpaper.com/start?session=${session}`, { ... });

The same ID is later injected into every main-frame request to predatorwallpaper.com/search as an extra parameter (key: "session"). Additionally, the extension registers an uninstall URL that includes the session ID:

chrome.runtime.setUninstallURL(`https://predatorwallpaper.com/uninstall?session=${session}`);

Finally, a dynamic sandbox run confirmed that the search provider setting is changed to https://predatorwallpaper.com/search?q={searchTerms}, causing all omnibox queries to go to that domain.

Payload

The payload consists of three components:

• Search hijacking: All searches from the address bar are sent to predatorwallpaper.com, which may display its own results or redirect to a third-party search engine while monetizing the traffic.
• Persistent session tagging: Each search query is augmented with the same session ID, enabling the operator to build a profile of the user's search behavior over time.
• Lifecycle beacons: The start and uninstall pings inform the operator when the extension is active and when it is removed, potentially for measuring install base or reacting to user attrition.

No credential harvesting, cookie access, or browsing-history exfiltration was observed in the first-party code.

Store status

As of this writing, the extension remains listed on the Chrome Web Store with the ID odkcfoohjiicbelloepgcomekdknchjh. We did not observe a takedown during our analysis. Users who have installed it should remove the extension immediately and consider clearing any stored data associated with predatorwallpaper.com in their browser.