Hijacking
Browser hijackers, forced-search extensions and adware
Software changes a person's browser so their searches go through a monetised search page they never chose, or injects extra ads into the pages they visit.
How it works
A browser hijacker arrives bundled with a free program or as an extension that promised something else. It changes the default search engine, home page or new-tab page to a look-alike search site. Every search the person makes now passes through that site, which shows feed ads and earns from the clicks. Adware goes a step further and inserts ads into pages, including on top of real search results.
To a feed, this traffic looks superb: real people typing real searches with real intent. That is why search hijacking has been the cash-out method for some of the largest botnets on record. The flaw is consent. The user did not choose that search provider, so the "query" was taken, not earned. Legitimate browser extension search monetisation exists, but it depends on clear disclosure, a single stated purpose and easy removal.
Who pays for it
Users lose control of their browser and are often tracked. The search engine they meant to use loses the search. Advertisers pay a middleman for a customer who was already looking for them. Feed partners with hijacked distribution face termination when it is found.
Who does it, and why
Software bundlers, extension developers and malware groups. Search traffic is the best-paid traffic on the web, so diverting it is more profitable than showing banners.
Warning signs
- Search traffic from an extension, toolbar or installer whose install flow is not clearly disclosed.
- Users reaching the search page only via changed browser settings, never by choice.
- Antivirus products flagging the software as potentially unwanted.
- High uninstall rates and user complaints about being unable to change search settings.
- Queries that mirror what users typed for another search engine.
Defences
- Before accepting extension or software traffic, walk through the install as a user would.
- Require plain disclosure of the search change, an opt-in, and one-click removal.
- Check the software's reputation with security vendors and browser stores.
- Monitor for query patterns copied from other engines, a mark of interception.
An example
Real cases: Microsoft said the Bamital botnet attacked more than 8 million computers over two years, diverting search clicks. ZeroAccess, with nearly 2 million machines, cost advertisers upwards of $2.7 million a month by Microsoft's estimate. Check Point attributed the 2017 Fireball hijacker, which pushed searches through fake engines to Yahoo and Google, to a marketing agency and estimated 250 million infections.
Documented cases
- Fireball (2017): Browser hijacker bundled with free software to force searches through fake search engines
- Bamital (2013): Search-hijacking and click-fraud botnet
- ZeroAccess (Sirefef) (2013): Peer-to-peer botnet for search hijacking and click fraud
- Redirector.Paco (2016): Botnet that replaced real search results with a monetised custom search feed
- Adrozek (2020): Browser-modifying malware that injected extra ads into search results
- DNSChanger (Operation Ghost Click) (2011): Malware that hijacked search-result clicks and swapped ads on infected computers
- FTC v. Zango (formerly 180solutions) (2006): Adware installed without proper consent to show ads and track browsing