Quick Search Tool Search Provider Hijack and Tracking

Overview

Quick Search Tool (Chrome extension ID keadechokmcohlcampccppbjjeabghcd, ~100,000 installs) is a search hijacker disguised as a search utility. Its current build, v1.3, silently replaces the user's default search provider and monetizes searches through affiliate tracking, while hiding its own store reviews. The behavior is not disclosed in its description; the extension performs actions that go beyond a simple search toolbar.

How it works

On install or update, the extension registers itself as the default search engine via manifest.json:14 ("is_default": true) and sets the search URL to https://query.quicksearchtool.com/s?query={searchTerms} (manifest.json:17). This means every address-bar search is sent to the vendor's server. In background.js, the extension uses chrome.declarativeNetRequest.updateDynamicRules (background.js:13) to add parameters like src, uid, ap, uc, i_id, and cid to the query URL (background.js:24), ensuring affiliate tags are attached regardless of user intent. The rule condition targets only main_frame requests to query.quicksearchtool.com/s (background.js:36).

The extension also logs a persistent user ID and traffic source to https://log.quicksearchtool.com/log?event=... on install (background.js:8, background.js:68). It reads a vendor cookie named qs to track users across sessions (background.js:60). Additionally, it opens a new tab to a monetized landing page on first install and on updates (background.js:78, background.js:87), and it monitors Yahoo search result pages to spawn popup windows (background.js:96, background.js:104).

A particularly deceptive behavior: the extension actively searches for the Chrome Web Store review page of its own extension ID and closes any matching tab (background.js:84), preventing users from seeing negative reviews.

Payload

The payload is a combination of browser setting manipulation, request rewriting, and user tracking. The extension does not steal passwords or cookies, but it monetizes user searches by redirecting them through affiliate links and hides evidence of user dissatisfaction. The persistent user ID allows the vendor to build a longitudinal profile of browsing/search habits.

Store status

As of this analysis, the extension remains live on the Chrome Web Store. No vendor response or removal has been observed. Users should uninstall it immediately and reset their default search engine in Chrome settings.