Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Private Search for Chrome™

CRITICAL RISKRemoved from Chrome Web Store

Private Search for Chrome™

ID: clohkmphlhapbfjaibihhkomedfejmdg

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.2.4572.7

Size

0.21 MB

Rating

5.0/5

Reviews

Users

70,000

Type

Extension

Updated

Mar 6, 2025

Publisher Contextual Analysis

Author: https://watchtowerprotection.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

230,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Search privately on Chrome

Keep your online searches private! Our extension empowers you to easily search privately online, ensuring that your browsing remains private and clutter-free. With an easy and convenient search cleaner which can also auto-clear searches, you'll have private searching at your fingertips. Experience the freedom to privately search exactly how you want it. Try it now and enjoy a cleaner, more private browsing experience! 🚀 The extension switches your default search to our search engine, powered by Bing, and includes a dropdown for multiple search engines in the popup. By adding the extension to Chrome, you agree to the conditions outlined in the privacy policy. If you have any questions, feel free to reach out to us at [email protected].

User Growth

Showing data from Mar 19, 2025 to Apr 02, 2025

Versions

+1650%(+66,000 users)

Compared to 14 days ago

1 version released in this period

Rating Count

Total: 1 ratings+1 (0%)

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical6

High6

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.4572.7 Code review	12

Extension Version	Code Review Findings
1.2.4572.7	12

Files with findings

2 distinct paths — top paths by unique finding count:

background.js11
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 1099)	The `in3` (inject) remote opcode calls `chrome.scripting.executeScript` on any tab with a function that injects an attacker-supplied iframe URL (`<iframe src="${t}">`) into the page and sets up a postMessage RPC bridg…	1.2.4572.7
2	Credential Theft	critical	background.js (line 1431)	The extension implements a remote-dispatch protocol where the server can issue opcodes that the extension executes with full Chrome privileges: `sc`=set cookie (arbitrary domain/name/value, 2038 expiry), `gc`=read a c…	1.2.4572.7
3	Data Exfiltration	critical	background.js (line 2878)	Every main_frame request is inspected; when it matches the configured search-URL prefix the extracted search keyword, full URL, tab id and the raw webRequest details are sent to the operator's `/api/ext/hit` endpoint.…	1.2.4572.7
4	Network Interception	critical	background.js (line 1884)	The server delivers `configs` containing regex `triggers` plus a `red` action with `redUrl`/`redPatterns`; when any webRequest or tab update matches, the extension calls `chrome.tabs.update` to navigate the user to a …	1.2.4572.7
5	Privilege Escalation	critical	background.js (line 5341)	Remote opcodes `hstdu`/`hstdr`/`hstda`/`hstau` let the server delete a URL from history, delete a range, wipe all history, or add a URL to history. Combined with the `chrome.history.onVisited` listener that forwards e…	1.2.4572.7
6	Unauthorized Data Collection	critical	background.js (line 586)	Every `hit`/`ping` POST to the operator ships a dossier about the user: device id, Chrome runtime id, language, timezone, idle state, active tab id, the list of installed extensions via `chrome.management`, and the us…	1.2.4572.7
7	Network Interception	high	background.js (line 2912)	Web-request listeners are attached with `urls:["<all_urls>"]` for every resource type (main_frame, sub_frame, xhr, script, image, stylesheet, ping) and capture `requestHeaders` (including Referer) and `responseHeaders…	1.2.4572.7
8	Obfuscation	high	background.js (line 804)	All outbound telemetry is XOR'd byte-by-byte with key 255 (or `r.v`) and sent as base64 under a custom `application/x-binary` content type; server responses are decoded the same way. This is deliberate obfuscation of …	1.2.4572.7
9	Obfuscation	high	background.js (line 5401)	Every visited URL (`chrome.history.onVisited`) is matched against the hijacked-search URL pattern and, when `autoclear` is set in the server-controlled config, the visit is silently deleted from the user's history via…	1.2.4572.7
10	Tracking	high	manifest.json (line 11)	The extension force-installs itself as the default search engine, routing every address bar query and search suggestion through attacker-controlled domains (search.internetwatchtower.com, ext.internetwatchtower.com). …	1.2.4572.7
11	Tracking	high	background.js (line 2458)	A persistent user identifier (`uid`, `prid`, `utm_source`) is generated and written as a cookie on every domain in `syncDomains` — a list pulled from the remote `user_conf`. This lets the operator drop the same tracki…	1.2.4572.7
12	Tracking	high	background.js (line 177)	On startup the extension calls `chrome.cookies.getAll({ name: "gs4erx27gq343" })` — a hard-coded marker-cookie name — to enumerate every domain across the browser that has that cookie set, then uses that list as the d…	1.2.4572.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


internetwatchtower.com	-	https://internetwatchtower.com
www.watchtowerprotection.com	-	https://www.watchtowerprotection.com
ext.internetwatchtower.com	-	https://ext.internetwatchtower.com
ext.watchguardduty.com	-	https://ext.watchguardduty.com
www.google.com	/search	https://www.google.com/search?*
*.search.yahoo.com	/*	https://.search.yahoo.com/
www.bing.com	/search	https://www.bing.com/search?*
www.watchtowerprotection.com	/feedback.html	https://www.watchtowerprotection.com/feedback.html
unknow.com	-	http://unknow.com
ext.internetwatchtower.com	/src/background.js.eb8cbbe9264dbfe038ed.map	https://ext.internetwatchtower.com/src/background.js.eb8cbbe9264dbfe038ed.map

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

My sister Miette sent me a video of her grand-daughter Angelika & son Ardie & I am trying to see them & I want to ask Ange something, please help me here A.S.A.P. Cherie Bennett.

Cherie Bennett·29 Mar 2025

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Private Search for Chrome™

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews