Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Quick Search Tool

CRITICAL RISKRemoved from Chrome Web Store

Quick Search Tool

ID: jlpenjcbjaocajkajjklmfomhohiodfa

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

3.3.2

Size

0.01 MB

Rating

3.2/5

Reviews

Users

200,000

Type

Extension

Updated

May 24, 2024

Publisher Contextual Analysis

Author: quicksearchtool.comView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

391,209

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Search the web using this useful tool from the address bar.

Quick access to yahoo searches from your browser search bar. This extension configures your default search setting to Quick Search Tool with results powered by Yahoo! This extension can be uninstalled at any time. Permissions & Reasons Used Our extension only uses the minimum permissions required. Install Dialog: "Read and change your data on all quicksearchtool.com sites" Permission: "://.quicksearchtool.com/*" Reason: "This allows our extension to work properly. We only request access to the website our extension runs on." "Change your search settings to: search.quicksearchtool.com" Reason: "This allows us to offer you useful searching capability from the address bar with results that go to Yahoo!" "Read your browsing history" Permission: "Tabs" Reason: "We use tabs to ensure we can offer you additional optional products. We do not store or transmit any of your browsing history." Additional Permissions Used: Permission: "Cookies" Reason: "Cookies are used to ensure you get the right user experience when you install our extension. Our extension only grabs the cookies we set on our pages." Permission: "Storage" Reason: "Used to save technical information locally on the extension to ensure you see the right content." Permission: "webRequestBlocking" and “webRequest” Reason: "This allows us to properly show you the search results you are looking for by sending you to the right place. Without it you would end up seeing the wrong Yahoo search results."

User Growth

Showing data from May 21, 2024 to May 31, 2024

Versions

+100%(+100,000 users)

Compared to 10 days ago

2 versions released in this period

Rating Count

Total: 17 ratings

Average Rating

Current: 3.24 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium2

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.2 Code review	8

Extension Version	Code Review Findings
3.2	8

Files with findings

1 distinct path — top paths by unique finding count:

background.js8

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	critical	background.js (line 274)	When a new tab is opened from a Yahoo Hosted Search results page bearing specific partner codes (`hspart=pty` or `hspart=adk`), the extension intercepts the tab and forcibly moves it into a new, precisely-sized side w…	3.2
2	Tracking	critical	background.js (line 23)	The `webRequestBlocking` listener intercepts every search query and rewrites the URL to append a persistent unique user ID (`uid`), ad provider, source, user class, and extension ID. This constitutes systematic tracki…	3.2
3	Unauthorized Data Collection	critical	background.js (line 58)	On install, the extension reads all cookies from `quicksearchtool.com` and extracts affiliate/traffic parameters (`ap`, `source`, `uid`) from a `qs` cookie. This reveals a pre-seeded affiliate tracking mechanism where…	3.2
4	Other	high	background.js (line 120)	Immediately after install, the extension queries all open tabs and silently closes any tab pointing to the Chrome Web Store page for this extension. This is an anti-forensics technique: it destroys the browser history…	3.2
5	Remote Code Loading	high	background.js (line 247)	The extension fetches a `Userclass` value from a remote server on every startup and search operation. This classification value is sent with every search query, impression, and install event. The remote server can dyn…	3.2
6	Tracking	high	background.js (line 193)	The `SendImpression` and `SendImpressionPlus` functions fire tracking beacons to `imp.quicksearchtool.com` on install (`ex_installed`) and update (`ex_updated`) events, carrying full user profile data including persis…	3.2
7	Tracking	medium	background.js (line 178)	Sets an uninstall URL that fires a tracking beacon containing the user's persistent UID, traffic source, ad provider, user class, and version upon removal. This ensures the advertising network is notified when a user …	3.2
8	Tracking	medium	background.js (line 108)	On install, the extension sets a `installuc` cookie on `quicksearchtool.com` containing the user's assigned class value with a 10-year expiration date. This creates a persistent cross-session identifier that survives …	3.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


log.${extensiondomain}	/log	https://log.${extensionDomain}/log?event=${event}&user_id=${uid}&source=${src}&traffic_source=${ap}&subid=${uc}&implementation_id=${extensionVertical}${extensionVersion}&subid2=${subId2}&page=${page}&offer_id=${extensionId}&referrer=${referrer}`
hp.${extensiondomain}	-	https://hp.${extensionDomain}?source=${src
hp.${extensiondomain}	/uninstall	https://hp.${extensionDomain}/uninstall?source=${src}&uid=${uid}&ap=${ap}&uc=${uc}&i_id=${extensionVertical}${extensionVersion}&cid=${extensionId}`
${extensiondomain}`}	-	https://${extensionDomain}`}
search.quicksearchtool.com	/favicon.ico	https://search.quicksearchtool.com/favicon.ico
search.quicksearchtool.com	/s	https://search.quicksearchtool.com/s?query={searchTerms}
search.quicksearchtool.com	/autosuggest	https://search.quicksearchtool.com/autosuggest?query={searchTerms}
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.7 out of 5 · 7 most recent reviews

Text reviews

Positive

Negative

Exactly what I was looking for, helps me search quickly without any hassle

Ryan Preiner·9 Aug 2021

criminal hacker (cracker) organization puts this out - do not download and remove as soon as you get this!

Mary Jane Bohus·3 Jul 2021

bbbbbbbb

Adrian Dyson·3 May 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Quick Search Tool

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews