A featured Chrome extension "Planet Search" (2M installs) routes every query to the nextgeeker[.]com hijacker network

Reddit •/u/Huge-Skirt-6990 • July 25, 2026

While analyzing featured extensions on our beloved chrome web store I landed on Planet ( kadaohckdkghfaclhjmkmplebcdcnfnp ), Featured, 2M users, publisher FREE VPN PLANET SRL . The extensions has a 0-byte background.js with zero permissions. The whole mechanism is one chrome_settings_overrides provider, so nothing shows up statically. It's all server-side. Declared provider is planet- [.]com . Tracing: planet- [.]com/ /?q= 301 → sstmaster[.]com/edge/PN1021?q= 302 → nextgeeker[.]com/B151001.php?q=&src=PN1021 nextgeeker[.]com is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others). PN1021 is the affiliate subid linking the extension's traffic to that network. The listing discloses none of the hops and says only that results come from Google (the final page is a Google CSE render). Same publisher ships a ~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have. Report: submitted by /u/Huge-Skirt-6990 [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chrome Extension 'Planet Search' Routes Queries to Hijacker Network The Chrome extension 'Planet Search', with 2 million installs, has been found to route user queries to the hijacker network nextgeeker.com. The extension, published by FREE VPN PLANET SRL, features a 0-byte background.js and zero permissions, indicating that its functionality is entirely server-side. Tracing reveals that user queries are redirected through multiple hops, ultimately leading to a page flagged as a browser hijacker by several security vendors. The extension's listing falsely claims that results are sourced from Google. The same publisher also offers a VPN extension with approximately 1 million users. Ongoing investigations are being conducted to assess the full scope of the publisher's other extensions. 3 sources 65

Extracted Entities

A featured Chrome extension "Planet Search" (2M installs) routes every query to the nextgeeker[.]com hijacker network

The full story

Extracted Entities

Attack Types (1)

Domains (2)

Tools (1)