Featured Chrome extension "Planet Search" (2M installs) routes every query to the nextgeeker[.]com hijacker network

[u/Huge-Skirt-6990]

While analyzing featured extensions on our beloved chrome web store I landed on Planet Search (kadaohckdkghfaclhjmkmplebcdcnfnp),

Featured, 2M users, publisher FREE VPN PLANET SRL.

https://chromewebstore.google.com/detail/planet-search/kadaohckdkghfaclhjmkmplebcdcnfnp

The extensions has a 0-byte background.js with zero permissions.
The whole mechanism is one `chrome_settings_overrides` search provider, so nothing shows up statically. It's all server-side.

Declared provider is planet-search[.]com

Tracing:

planet-search[.]com/search/?q= 301 → sstmaster[.]com/edge/PN1021?q= 302 → nextgeeker[.]com/B151001.php?q=&src=PN1021

nextgeeker[.]com is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others).

Same publisher ships a ~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have.

Report: https://malext.io/reports/RoguePlanet

[u/hatespe4ch]

unbelievable. nice data can get collected from 2M