Chrome Extension 'Planet Search' Routes Queries to Hijacker Network

The Chrome extension 'Planet Search', with 2 million installs, has been found to route user queries to the hijacker network nextgeeker.com. The extension, published by FREE VPN PLANET SRL, features a 0-byte background.js and zero permissions, indicating that its functionality is entirely server-side. Tracing reveals that user queries are redirected through multiple hops, ultimately leading to a page flagged as a browser hijacker by several security vendors. The extension's listing falsely claims that results are sourced from Google. The same publisher also offers a VPN extension with approximately 1 million users. Ongoing investigations are being conducted to assess the full scope of the publisher's other extensions.

Key Points: • The 'Planet Search' extension has 2 million installs and routes queries to a hijacker network. • It features a 0-byte background.js, indicating server-side functionality without user permissions. • The publisher, FREE VPN PLANET SRL, also has a VPN extension with around 1 million users.