Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Quick Search Tool

CRITICAL RISKRemoved from Chrome Web Store

Quick Search Tool

ID: kaaihkpfpeglheidoidkimmgelahcdme

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.7

Size

0.01 MB

Rating

0.0/5

Reviews

Users

31,209

Type

Extension

Updated

Aug 28, 2021

Publisher Contextual Analysis

Author: quicksearchtool.comView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

391,209

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Search the web using this useful tool from the address bar.

Quick access to yahoo searches from your browser search bar or recent searches toolbar. This extension configures your default search setting to Quick Search Tool with results powered by Yahoo!. You will also get a recent and trending searches toolbar to make searching even easier! This extension can be uninstalled at any time.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High5

Medium2

Low0

Versions scanned

Showing 1 of 6 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.6 Code review	7

Extension Version	Code Review Findings
1.6	7

Files with findings

1 distinct path — top paths by unique finding count:

background.js7

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	high	background.js (line 21)	Uses declarativeNetRequest to silently rewrite outgoing search queries with monetization/affiliate identifiers (source, uid, ap, uc, implementation_id, click_id). Combined with the chrome_settings_overrides search_pro…	1.6
2	Network Interception	high	background.js (line 158)	Watches every newly-created tab and, when the opener is a Yahoo search result page tagged with this extension's affiliate param3 token, detaches the tab into a popup-style window covering the right half of the screen.…	1.6
3	Obfuscation	high	background.js (line 144)	Immediately after installation, the extension searches for and force-closes any Chrome Web Store tab that contains its own listing. This anti-review behavior prevents users from reading reviews, reporting, or uninstal…	1.6
4	Tracking	high	background.js (line 9)	Exfiltrates a persistent user_id and affiliate attribution params (source, traffic_source, subid, referrer) to log.quicksearchtool.com on install, update, and other lifecycle events. The user_id is generated client-si…	1.6
5	Unauthorized Data Collection	high	background.js (line 103)	Uses the cookies permission to read a 'qs' cookie set by the operator's web property prior to installation, allowing the upstream landing page / ad campaign to embed an affiliate ID (source, uid, ap) that the extensio…	1.6
6	Tracking	medium	background.js (line 78)	On install and update events, force-opens a tab to hp.quicksearchtool.com loaded with affiliate attribution parameters and the per-user tracking UUID. This is monetization-driven traffic generation tied to a specific …	1.6
7	Tracking	medium	background.js (line 91)	Registers an uninstall URL that exfiltrates the persistent user_id and full affiliate attribution chain to the operator's server when the user removes the extension. Combined with the install-time logging this builds …	1.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


log.${extensiondomain}	/log	https://log.${extensionDomain}/log?event=${event}&user_id=${uid}&source=${src}&traffic_source=${ap}&subid=${uc}&implementation_id=${extensionVertical}${extensionVersion}&subid2=${subId2}&page=${page}&offer_id=${extensionId}&referrer=${referrer}`
hp.${extensiondomain}	-	https://hp.${extensionDomain}?source=${src
hp.${extensiondomain}	/uninstall	https://hp.${extensionDomain}/uninstall?source=${src}&uid=${uid}&ap=${ap}&uc=${uc}&i_id=${extensionVertical}${extensionVersion}&cid=${extensionId}`
${extensiondomain}`	-	https://${extensionDomain}`
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
search.quicksearchtool.com	/favicon.ico	https://search.quicksearchtool.com/favicon.ico
query.quicksearchtool.com	/s	https://query.quicksearchtool.com/s?query={searchTerms}
search.quicksearchtool.com	/autosuggest	https://search.quicksearchtool.com/autosuggest?query={searchTerms}

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Quick Search Tool

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 6 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating