It even has over 200K installations that could build confidence in the user to install the extension on their browser. WebSecurerr Browser Protection aims to provide better protection against websites with malicious codes and malware. However, by doing so, they tend to “hijack” the browser, persuading the user to use other services - setting up the trap to steal data using malware-infected websites and programs.

All three extensions claimed to provide additional features to the standard search options by replacing them with new ones. Technical analysis of browser hijacker extensionsĬIRL researchers collected three browser hijacker extensions: WebSecurerr Browser Protection, Ultrasurf, and Internet-Start. A detailed analysis of the methodology and execution of browser hijacker extensions is given below. Instead of using Google search as the default, the results are either shown in Yahoo or Bing, which can be used to gather user data for displaying personalized adverts to pursue the victim to click them.Īccording to the CIRL researchers who spoke to The Cyber Express, the browser hijackers were found in their regular “research activities” and affected the users “who installed it and people who’re using chromium-based browsers.” In the technical analysis of the extensions, three mainly targeted Chromium-based browsers. Once installed, these extensions route users’ queries via various servers and complex direction mechanisms contrary to how the standard Google, Bing, or any known search engine works. Browser hijackers: An enigma of cyber attacksīrowser hijackers come in all shapes and sizes - existing solely on the internet browser to steal information and spread malware. The extensions become defunct after changing the browser to its default settings. Once installed on the target’s web browser, it can “open doors for future attacks by redirecting users to malicious websites,” said the CRIL brief on the discovery. It is often called the “browser redirect virus” because it forces users to visit other malicious websites they initially never intended to visit.

Google webstore