Featured Chrome extension "Planet Search" (2M installs) routes every query to the nextgeeker[.]com hijacker network

Reddit •/u/Huge-Skirt-6990 • July 25, 2026

While analyzing featured extensions on our beloved chrome web store I landed on Planet ( kadaohckdkghfaclhjmkmplebcdcnfnp ), Featured, 2M users, publisher FREE VPN PLANET SRL. The extensions has a 0-byte background.js with zero permissions. The whole mechanism is one `chrome_settings_overrides` provider, so nothing shows up statically. It's all server-side. Declared provider is planet- [.]com Tracing: planet- [.]com/ /?q= 301 → sstmaster[.]com/edge/PN1021?q= 302 → nextgeeker[.]com/B151001.php?q=&src=PN1021 nextgeeker[.]com is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others). Same publisher ships a ~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have. Report: submitted by /u/Huge-Skirt-6990 [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chrome Extension 'Planet Search' Routes Queries to Hijacker Network The Chrome extension 'Planet Search', with 2 million installs, has been found to route user queries to the hijacker network nextgeeker.com. The extension, published by FREE VPN PLANET SRL, features a 0-byte background.js and zero permissions, indicating that its functionality is entirely server-side. Tracing reveals that user queries are redirected through multiple hops, ultimately leading to a page flagged as a browser hijacker by several security vendors. The extension's listing falsely claims that results are sourced from Google. The same publisher also offers a VPN extension with approximately 1 million users. Ongoing investigations are being conducted to assess the full scope of the publisher's other extensions. 3 sources 65

Extracted Entities

Featured Chrome extension "Planet Search" (2M installs) routes every query to the nextgeeker[.]com hijacker network

The full story

Extracted Entities

Attack Types (1)

Domains (2)

MITRE ATT&CK (1)

Tools (1)