Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Search Images on Chrome™

CRITICAL RISKRemoved from Chrome Web Store

Search Images on Chrome™

ID: eekblbhfmladafbmpgkdedmolbjkjbnc

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.0.1965.0

Size

0.30 MB

Rating

1.7/5

Reviews

Users

30,000

Type

Extension

Updated

May 16, 2024

Publisher Contextual Analysis

Trusted

Author: https://thesqout.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

538,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Change your default search to easily search for images on the web.

Improve your image searching experience with Search Images on Chrome. Easily search for images directly from the search bar and we’ll take you straight to image results for your search. To use the extension, just type ‘img’ into the search bar, press the spacebar, and then type what image you want to search for. Our search will take you right to the image results so that you search for what you want faster. This extension switches the default search settings to our search engine. The extension requests cookies permissions in order to save settings and collects basic search data to ensure functionality of the extension. To read more, please click the Privacy Policy link to the right of this description. If you have any issues, contact us at [email protected].

User Growth

Showing data from May 24, 2023 to May 22, 2024

Versions

No change in user count

Compared to 3 months ago

5 versions released in this period

Rating Count

Total: 3 ratings

Average Rating

Current: 1.67 / 5.0+1.67

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High7

Medium2

Low1

Versions scanned

Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.1428.0 Code review	12

Extension Version	Code Review Findings
1.0.1428.0	12

Files with findings

2 distinct paths — top paths by unique finding count:

background.js11
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 5976)	Captured network events (URL, hostname, path, query, hash, IP, status, method, frame IDs, timestamps, tab title, favicon, referer, redirect chains) are batched (max 20 / 100ms) and POSTed to the C2 endpoint /api/sq/po…	1.0.1428.0
2	Network Interception	critical	background.js (line 6189)	The 'redUrl' / 'redPatterns' branch reads a redirect template plus regex patterns from the remote config and rewrites the active tab's URL via chrome.tabs.update (Nt.i). This is server-controlled, on-the-fly traffic r…	1.0.1428.0
3	Credential Theft	high	background.js (line 3041)	Generic wrappers around chrome.cookies.get, getAll, getAllCookieStores, and a setter that writes cookies with expirationDate=2147483647 (max int — the 'forever' trick used to plant durable tracking IDs). The cookies p…	1.0.1428.0
4	Data Exfiltration	high	manifest.json (line 11)	The extension hijacks Chrome's default search engine, forcing every address-bar/keyword search and every suggestion keystroke to be sent to attacker-controlled hosts (search.searchsqout.com and ext.searchsqout.com). T…	1.0.1428.0
5	Network Interception	high	background.js (line 6728)	The background script registers webRequest listeners on <all_urls> across every resource type (main_frame, sub_frame, stylesheet, script, image, object, xmlhttprequest, ping, other) and captures request headers, respo…	1.0.1428.0
6	Obfuscation	high	background.js (line 237)	Outbound POSTs to the C2 are XOR-encoded with byte 0xFF and base64-wrapped, then sent as content-type 'application/x-binary'; responses with the same content-type are XOR-decoded on receipt. This pseudo-encryption lay…	1.0.1428.0
7	Privilege Escalation	high	background.js (line 4242)	Self-management hooks call chrome.management.uninstallSelf and chrome.management.setEnabled to disable or remove other extensions / itself in response to remote-driven menu actions ('genDis', 'genUn'). Combined with t…	1.0.1428.0
8	Unauthorized Data Collection	high	background.js (line 6571)	The onSendHeaders listener pulls the Referer header out of every outbound request and stores it keyed by requestId and tabId, later attached to events that are POSTed to the C2 (see Dn/Cn/'net_items'). Harvesting Refe…	1.0.1428.0
9	Unauthorized Data Collection	high	background.js (line 6683)	Every search the user performs (keyword, full search URL, tab id, and the raw webRequest details) is forwarded to the C2 via the 'client_side_search' action. Combined with the manifest's search-engine override, the op…	1.0.1428.0
10	Tracking	medium	background.js (line 8112)	On install, the extension calls chrome.runtime.setUninstallURL pointing at <apiDomain>/api/sq/uninstall?eid=<extensionId>. This causes a server beacon (and typically an attacker-controlled landing page) to fire whenev…	1.0.1428.0
11	Tracking	medium	background.js (line 7408)	Every C2 POST is enriched with a fingerprint envelope: extension id, runtime id, version, manifest_version + declared permissions, navigator.language, local_time, timezone, idle state, active tab id, and whether the '…	1.0.1428.0
12	Other	low	background.js (line 8327)	The bundle's source map points at ext.searchsqout.com — confirming that the same host receiving telemetry, redirect configs, and 'net_items' batches is the operator-controlled CDN that built and shipped this code. The…	1.0.1428.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


searchsqout.com	-	https://searchsqout.com
thesqout.com	-	https://thesqout.com
ext.searchsqout.com	-	https://ext.searchsqout.com
ext.sqouterr.com	-	https://ext.sqouterr.com
thesqout.com	/feedback.html	https://thesqout.com/feedback.html
unknow.com	-	http://unknow.com
www.bing.com	/images/search	https://www.bing.com/images/search?q=
ext.searchsqout.com	/src/background.js.1e2595b3dfdb7eb34c57.map	https://ext.searchsqout.com/src/background.js.1e2595b3dfdb7eb34c57.map
ext.searchsqout.com	/src/style.css.1e2595b3dfdb7eb34c57.map*/	https://ext.searchsqout.com/src/style.css.1e2595b3dfdb7eb34c57.map*/
npms.io	/search	https://npms.io/search?q=ponyfill.

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.7 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

it works well on roblox

john cens·1 Jun 2023

it does nothing at all

Amy Eller·31 May 2023

I have no idea what this extension is at all. everytime I try to download litteraly anything onto my PC i'm taken to a page that says before you download get Fast pix for chrome with an install button. tried installing this to see if the issue would go away and nope. still the same page but it tells me already installed. seriously let me use my computer google what kinda garbage is this

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Search Images on Chrome™

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 5 Versions12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating