Hotsearch.io Hijacks Search Queries
Hotsearch.io is a counterfeit search engine accessed through the HotSearch browser extension, which functions as a browser hijacker. This extension alters browser settings to trigger redirects to the hotsearch.io website.
Our investigation revealed that HotSearch was installed on our test machine via a deceptive installation setup obtained from a Torrenting website. It's important to note that such installers often bundle multiple unwanted or harmful software programs.
Browser hijackers typically configure promoted sites as default search engines, new tab pages, and homepages within web browsers. Consequently, when users enter search queries into the URL bar or open new tabs or windows, they are redirected to the endorsed webpage—in this case, hotsearch.io.
Fraudulent search engines like hotsearch.io are unable to provide legitimate search results and instead redirect users to legitimate search engines such as Google, Bing, or Yahoo. In the case of Hotsearch.io, it redirects users to the boyu.com.tr fake search engine, which does produce search results but may include inaccurate, sponsored, deceptive, or potentially harmful content.
Additionally, browser hijackers often employ persistence techniques to prevent easy removal. For instance, HotSearch utilizes the "Managed by your organization" feature in Google Chrome to complicate uninstallation.
Furthermore, software of this nature typically possesses data-tracking capabilities, and HotSearch may be no exception. It could collect various user data including URLs visited, viewed webpages, search queries, browser cookies, login credentials, personally identifiable information, financial data, and more. This sensitive information may be sold to third parties or exploited for profit.
What Are Rogue Browser Extensions?
Rogue browser extensions, also known as malicious or unwanted browser extensions, are software components that can be added to web browsers to modify their functionality. However, unlike legitimate browser extensions that enhance browsing experience, rogue extensions are designed with malicious intent and can pose various risks to users. Here are key characteristics and risks associated with rogue browser extensions:
Malicious Intent: Rogue browser extensions are created to perform harmful actions on a user's browser or system. This can include displaying intrusive advertisements, redirecting web traffic to malicious websites, stealing sensitive information (such as login credentials or browsing history), or installing additional malware onto the user's device.
Unauthorized Behavior: Rogue extensions often engage in unauthorized behaviors without the user's consent or knowledge. This can include modifying browser settings (such as changing the default search engine or homepage), injecting unwanted advertisements into webpages, or tracking and collecting user data for malicious purposes.
Distribution Methods: Rogue extensions are typically distributed through deceptive means. They may be bundled with freeware or shareware applications, distributed through malicious websites, or promoted via misleading advertisements and download links. Users may inadvertently install rogue extensions when downloading and installing other software.
Browser Hijacking: Rogue extensions can hijack the user's browsing experience by redirecting web traffic, injecting unwanted scripts into webpages, or displaying persistent pop-ups and advertisements. This can lead to a degraded browsing experience and expose users to security risks.
Data Privacy Risks: Many rogue extensions are designed to collect sensitive user data, such as browsing history, login credentials, or financial information. This data can be exploited for identity theft, fraud, or other malicious activities.
Security Vulnerabilities: Rogue browser extensions can introduce security vulnerabilities into the user's browser or system. They may contain exploitable code that allows attackers to gain unauthorized access, execute arbitrary commands, or install additional malware.
