Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: MultiSearch for Chrome™

CRITICAL RISKRemoved from Chrome Web Store

MultiSearch for Chrome™

ID: jgajjllfidghjkjfipmjbaegafkdpfha

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.2355.0

Size

0.80 MB

Rating

4.0/5

Reviews

Users

100,000

Type

Extension

Updated

Sep 6, 2024

Publisher Contextual Analysis

Trusted

Author: https://thesqout.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

538,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Auto-switch search by language.

Navigate the web with ease using MultiSearch for Chrome™ which automatically detects your input language and switches to the most relevant search engine🔍. Whether you're searching in English, Russian, or other supported languages, enjoy seamless browsing tailored to your needs. Perfect for multilingual users and those who want a more intuitive search experience. No more manual adjustments—just type, search, and explore with the best results! For support or inquiries, contact us at [email protected].

User Growth

Showing data from Feb 16, 2025 to Sep 01, 2025

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 2 ratings

Average Rating

Current: 4.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High5

Medium0

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.2355.0 Code review	11

Extension Version	Code Review Findings
1.0.2355.0	11

Files with findings

3 distinct paths — top paths by unique finding count:

background.js9
index.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 2598)	The background worker ships a full remote-DOM RPC payload to every tab via chrome.scripting.executeScript (line 2560) and listens on window.postMessage with magic key 'mmm123'. The injected handlers allow an attacker …	1.0.2355.0
2	Data Exfiltration	critical	manifest.json (line 11)	The extension forcibly overrides the browser's default search engine to 'sQout' and routes every address-bar query and keystroke-level suggestion request to attacker-controlled domains (search.searchsqout.com / ext.se…	1.0.2355.0
3	Data Exfiltration	critical	background.js (line 4308)	Batches up to 20 captured network events (from the <all_urls> webRequest listeners) into an 'itemCache' and periodically POSTs them to ext.searchsqout.com/api/sq/post as the 'net_items' action. This is the exfiltratio…	1.0.2355.0
4	Network Interception	critical	background.js (line 4808)	Remote-configured trigger engine: the server pushes 'configs' with url regex 'triggers' and actions of type 'redirect' or 'iframe' (see I.REDIRECT/I.IFRAME at line 359). On any matching webRequest or tab update, the e…	1.0.2355.0
5	Privilege Escalation	critical	background.js (line 2554)	Generic executeScript wrapper that accepts an arbitrary function and args and runs it in any tab. Combined with the runtime at L() (line 2598) and the netConf trigger engine, this gives the extension's server full scr…	1.0.2355.0
6	Code Injection	high	index.js (line 2835)	Injects an iframe sourced from a server-supplied URL (`e`) into arbitrary pages via innerHTML concatenation with only loose style/src wrapping. Because src/style come from remote config, this is both an HTML injection…	1.0.2355.0
7	Obfuscation	high	background.js (line 2071)	Custom XOR-with-0xFF + base64 obfuscation (application/x-binary) applied to both outgoing POST bodies and incoming responses, with credentials:'include' so browser cookies for the C2 domain are attached. This is a del…	1.0.2355.0
8	Tracking	high	background.js (line 4982)	onSendHeaders listener (registered with extraHeaders + requestHeaders on <all_urls>) harvests the Referer header from every outgoing request and stores it by requestId/tabId. It is later attached to 'client_side_searc…	1.0.2355.0
9	Tracking	high	background.js (line 4088)	Uses the cookies permission to write persistent tracking cookies (expirationDate 2147483647 = year 2038, SameSite=None) onto a server-supplied list of third-party domains ('syncDomains' in USER_CONF). Combined with th…	1.0.2355.0
10	Unauthorized Data Collection	high	background.js (line 6247)	Attaches webRequest listeners on <all_urls> across all resource types (main_frame, sub_frame, stylesheet, script, image, xmlhttprequest, ping...) with extraHeaders, requestHeaders, and responseHeaders extracted. This …	1.0.2355.0
11	Other	low	background.js (line 9883)	Source-map URL pins the bundle to the C2 infrastructure at ext.searchsqout.com/src/, confirming that the same server that receives exfiltrated data and serves runtime netConf also hosts the original build artifacts. C…	1.0.2355.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


searchsqout.com	-	https://searchsqout.com
thesqout.com	-	https://thesqout.com
ext.searchsqout.com	-	https://ext.searchsqout.com
ext.sqouterr.com	-	https://ext.sqouterr.com
thesqout.com	/feedback.html	https://thesqout.com/feedback.html
unknow.com	-	http://unknow.com
ext.searchsqout.com	/src/background.js.efb132959af849762330.map	https://ext.searchsqout.com/src/background.js.efb132959af849762330.map
ext.searchsqout.com	/src/style.css.efb132959af849762330.map*/	https://ext.searchsqout.com/src/style.css.efb132959af849762330.map*/
npms.io	/search	https://npms.io/search?q=ponyfill.
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.0 out of 5 · 2 most recent reviews

Text reviews

Positive

Negative

yes animoji

Amber Donaldson·20 Nov 2024

bình thường

Phạm Ngọc·5 Oct 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

MultiSearch for Chrome™

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating