Skip to content
ThreatCluster

Chrome Extension 'Planet Search' Routes Queries to Hijacker Network

First seen 25 Jul 2026, 21:39 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •July 26, 2026 at 20:35 UTC
  • •The 'Planet Search' extension has 2 million installs and routes queries to a hijacker network.
  • •It features a 0-byte background.js, indicating server-side functionality without user permissions.
  • •The publisher, FREE VPN PLANET SRL, also has a VPN extension with around 1 million users.

The Chrome extension 'Planet Search', with 2 million installs, has been found to route user queries to the hijacker network nextgeeker.com. The extension, published by FREE VPN PLANET SRL, features a 0-byte background.js and zero permissions, indicating that its functionality is entirely server-side. Tracing reveals that user queries are redirected through multiple hops, ultimately leading to a page flagged as a browser hijacker by several security vendors. The extension's listing falsely claims that results are sourced from Google. The same publisher also offers a VPN extension with approximately 1 million users. Ongoing investigations are being conducted to assess the full scope of the publisher's other extensions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 56d ago How this analysis works

Timeline

2026-07-25
Discovery of malicious behavior in 'Planet Search' extension
The Chrome extension was found to redirect user queries to nextgeeker.com, a known hijacker.
Reddit
2026-07-25
Multiple vendors flag nextgeeker.com as a hijacker
Security vendors including pcrisk and gridinsoft identified nextgeeker.com as a browser hijacker.
Reddit
2026-07-25
Ongoing investigation into publisher's other extensions
Investigators are tracing additional extensions from the same publisher, which may also pose risks.
Reddit

More articles in this cluster (3)

Extracted Entities (6)

1 / 3