medium search hijacking chrome

searchjacked

23 browser extension(s) named as search hijacking in an outside report.

STIX 2.1 under our terms, no commercial use

Overview

An outside report (source) names 23 browser extension(s), with about 82367 installs between them, as search hijacking. The extensions are listed below with their store ids and, where the report gives one, the hash of the build it names.

How to spot it

Check installed extensions against the store ids in this entry and remove any that match. Administrators can block the ids by policy.

Affected extensions (23)

Name	Store	ID	Malicious version	Archived
MapQuest Directions View analysis	chrome	ljocfgbodlhbdiiojpdnimkomffghman	1.1.5	no
Prime Cinema View analysis	chrome	ckghkinegbnngbllkeokmfljeolecdma	1.1.0	no
Top Green Search View analysis	chrome	fohciagejckehfgeoipcilnpmnnakkpj	1.0.2	no
MyWallPaper View analysis	chrome	jhkeieglkjflimimljpaenphjhkbcieh	1.1.3	no
Search Pro View analysis	chrome	odcghonlbhgdidcpnalibbafopglelec	1	no
Clarie View analysis	chrome	obkoocpicbjnoaljdjbadoadkoemchlp	1.24.220	no
Brisk View analysis	chrome	bfkldmcajhbcbfmmelihdimnnekdnikj	1.0.3	no
Freshy Recipes View analysis	chrome	lkfegegmfppkbbacbpknfiifgbmcdbhl	1.21.1018	no
Focus New Tab View analysis	chrome	hpjbfdmahbjapdecnmioifehkallpcfn	0.2.3	no
Focus Search View analysis	chrome	obengahfabphpfidcaahbfgkhhdfjjlm	1.0.1	no
Let's Compare - Same Product Less Money! View analysis	chrome	mpceagkhdfgnfejligiknbkffpcdkooi	2.0.5	no
Cashback Alert View analysis	chrome	jjplgdahehldgdmahmiknpoeecbeadll	0.0.5	no
Package Tracking View analysis	chrome	epmbfbejbjifjdikfmgmnlmmhaflbggk	1.2	no
Shortcut Search View analysis	chrome	ophpcljoaaefmmonnlaelpoenijbacbo	1.0.0.0	no
ShopNSurf View analysis	chrome	gffoambnolcdhekfpgjoocfpgieapdbf	1.0.0.3	no
Search Safe Security View analysis	chrome	ihfofbafgkhbnpabmhfialdkmbkiaieb	1.0.2	no
Explore News View analysis	chrome	nkgkcoickdkcanpcagjcoikcenlkebac	1.0.1	no
Video Search Helper View analysis	chrome	ccacohemffhgjbmkbidkhmadgecnlooi	1.0.1	no
Incognito Search Helper View analysis	chrome	iiacojpoloobeeibmnlihiodpiijghln	1.0.3	no
Multilingual Search Assistant View analysis	chrome	ipgfebbljebgjchcpnpdcejgddmeadbn	1.0.0	no
Smart Lookup View analysis	chrome	kbknfhedpcnjidkngmcbgccfilghfbgg	1.0.2	no
Fresh View Search View analysis	chrome	mepcegjolholpjggdikkgdkkofednhop	1.0.1	no
Map Search Assistant View analysis	chrome	nelaiklcdfdgphmipgegnlgconfmicgc	1.0.0	no

Indicators of compromise (23)

sha256	124dd694302ccc37d0ad7f6a6d011100ef1fdeb8194283dd0674f8fe986ef34e		MapQuest Directions 1.1.5, hash as published in https://socket.dev/blog/searchjacked
sha256	35087073cbf39417ea892912516a462ccf755bf812885779555d2c23fe3d65c0		Prime Cinema 1.1.0, hash as published in https://socket.dev/blog/searchjacked
sha256	59fce3fd3a0313ca556fd0c3c5f5910473bb614e8d056548e1d0c105bb0a3004		Top Green Search 1.0.2, hash as published in https://socket.dev/blog/searchjacked
sha256	d3e34c95c70b3b38d2d26ef9f5cd2b201785e592842eed8a8b701c06a019cf81		MyWallPaper 1.1.3, hash as published in https://socket.dev/blog/searchjacked
sha256	e4b576d2f49ef1e79dfef08b00d269c8be1a0695f7277db14d268cd2997f678d		Search Pro 1, hash as published in https://socket.dev/blog/searchjacked
sha256	eb3eea0f5efae41e734eb18afa5d442a42aac66fd92557b94bd899d8d6f7ec4c	sample	full CRX, analysed build archived in R2 (Clarie 1.24.220)
sha256	8c04e8d48fc33a3a8d8033facc43aa45765d01eac29c9dfe811c7782fd2cba4b	sample	full CRX, analysed build archived in R2 (Brisk 1.0.3)
sha256	0af710be54fc1b6387f8d1c18637cd17537b3d90ebd1f4e2a0b28953f80069b4	sample	full CRX, analysed build archived in R2 (Freshy Recipes 1.21.1018)
sha256	981229abf05763129a6178b28f0a38e07a4df89051907830746f1d3cbe2f6de0		Focus New Tab 0.2.3, hash as published in https://socket.dev/blog/searchjacked
sha256	6ccfb320697f2885034daa556fc0c3cd4430405665cdcebd0c51fc6e696decc9	sample	full CRX, analysed build archived in R2 (Focus Search 1.0.1)
sha256	44597512a66ba8364a7e0970c07b9fe95c6af24ebded10844abacb903216d3dc		Let's Compare - Same Product Less Money! 2.0.5, hash as published in https://socket.dev/blog/searchjacked
sha256	ef2bbac0bea5168214d1e666657bdeec0e679a8ad9b3fd6cf194614a2a8438ca	sample	full CRX, analysed build archived in R2 (Cashback Alert 0.0.5)
sha256	a54ffde71b238dc2a26400f0e7c63d532b0cf4ff2395e769f1f8622a9aa059c7		Package Tracking 1.2, hash as published in https://socket.dev/blog/searchjacked
sha256	721093c45ed61831c3469ed60e534ae9c6e951f1a46d2686f2511b2e17062fa3		Shortcut Search 1.0.0.0, hash as published in https://socket.dev/blog/searchjacked
sha256	f4b0eb6d7226b030cbedb74afd1776fb89ae4581bbce44bd1cd9e2f45425485a	sample	full CRX, analysed build archived in R2 (ShopNSurf 1.0.0.3)
sha256	7817eb82b442411922d64b1b367f3a49a16686588d1542e1c07947b42a38e04e	sample	full CRX, analysed build archived in R2 (Search Safe Security 1.0.2)
sha256	70caa5c696481d25b3851dc34346647bf0332ff4bbdc62af735a613e9a94c749	sample	full CRX, analysed build archived in R2 (Explore News 1.0.1)
sha256	6a648e552228982dfd54a32be3ddd3618e244c80e620bd5094aa89849e1168ae	sample	full CRX, analysed build archived in R2 (Video Search Helper 1.0.1)
sha256	8e28a582ab05d7b194cc5652cf81ed30f95b36bd227c0c08e3895821a4fa8bd3	sample	full CRX, analysed build archived in R2 (Incognito Search Helper 1.0.3)
sha256	0a3582c28df987ab9a67017234b52447b9dbd48e3e4676a9101b9326f8286c3d	sample	full CRX, analysed build archived in R2 (Multilingual Search Assistant 1.0.0)
sha256	5a962785bb23e199a47203f8547ff567330f68f3bfc3862f20008ff712d197d2	sample	full CRX, analysed build archived in R2 (Smart Lookup 1.0.2)
sha256	ed7761c4bb78d7c0bfd8b1f7aee30663e9d4240feac68577ff0a8fade6aff71d	sample	full CRX, analysed build archived in R2 (Fresh View Search 1.0.1)
sha256	474614a78adfaa09a3c52306fa39babf9062825ebb424c0af65e963f4490a180	sample	full CRX, analysed build archived in R2 (Map Search Assistant 1.0.0)

Sources

https://socket.dev/blog/searchjacked