Browser hijackers, adware and malvertising

Search feeds pay because a search reveals what someone wants. That only holds if the person chose where to search and what to type. Search hijacking breaks the first half of that: software on the user's device quietly changes where their searches go. The person still wants what they typed, but they never chose the search page that now earns money from them.

You ask a taxi driver for the best curry house in town. He drives you to his cousin's restaurant, where he gets a commission. You did want curry. You did eat. But the restaurant paid a finder's fee for a customer who was delivered, not persuaded, and you never agreed to the detour.

The legitimate version

It helps to start with what is allowed. Search engines pay browsers, phone makers and software companies to send them searches. A default search deal is the largest form of this. On a smaller scale, browser extension search monetisation lets the maker of a browser add-on, such as a new-tab page, earn a share when users search through it. This is a real, permitted business, provided the user was clearly told that their search settings would change, agreed to it, and can undo it easily.

Where it becomes hijacking

A browser hijacker earns from the same feeds as legitimate extensions, which is exactly why it is damaging: its searches are mixed in with honest ones. The user's intent is often genuine, so conversion rates may not look terrible. The breach is consent.

Adware: making searches and clicks the user never made

Adware goes further. Once installed, usually bundled with free software, it can insert extra ads into pages, replace the ads a search engine showed with its own, or generate searches and clicks in the background with no human involved at all. Background searches are a form of query fraud, and background clicks are plain click fraud. When adware claims credit for a visit or purchase that would have happened anyway, it overlaps with cookie stuffing.

Microsoft documented a clear example in December 2020. It described a malware family it called Adrozek, which modified browsers including Chrome, Edge and Firefox to inject extra ads into search results pages. Microsoft said that at its peak in August 2020 the threat was observed on more than 30,000 devices a day, and that the operators earned through affiliate programmes that paid for traffic referred to certain pages.

Malvertising: the delivery route

Malvertising means using advertising itself to spread harmful software or scams. An ad, sometimes placed through a normal ad network, leads to a fake "update your browser" page or a bogus download. The user installs it and now has a hijacker or adware. Malvertising also includes forced redirects, where an ad's code sends a visitor to another site without a click. Those forced visits are sometimes sold onward as traffic, which connects this lesson back to traffic laundering.

So the pieces fit together as a loop: malvertising installs the software, the software hijacks searches or fabricates clicks, and a search feed, unknowingly, pays for them.

Who pays and who is hurt

• The user loses control of their browser, sees worse results, and is exposed to further scams because someone else now controls their traffic.
• The advertiser pays for clicks on ads that were inserted or forced, and sometimes pays twice when a genuine click is intercepted.
• The search engine and feed provider unknowingly pay out a revenue share, then have to recover it.
• Honest extension publishers face tighter rules and suspicion because of the dishonest ones.

Red flags in feed data

• Searches arriving from a "source" that is a single extension or toolbar ID with a very large and sudden user base.
• Queries that look machine-made: identical strings, odd formatting, or terms unrelated to each other from the same user in seconds.
• Navigational queries, such as brand names, arriving in bulk. These suggest people who meant to go somewhere else.
• High search volume with very little engagement afterwards, or ad clicks with no dwell time on the advertiser's site.
• User complaints or store reviews saying "this changed my search engine and I cannot remove it".