SmashJacker

Analysis

SmashJacker is a browser search engine hijacker first documented by ConnectWise in June 2023. Distributed through sites advertising “the download of wallpapers, software, games, and movies,” often via a pay-per-installer that Red Canary tracks as Charcoal Stork, SmashJacker installs a browser extension designed to redirect search engine queries and serve additional advertisements that provide income for adversaries. ConnectWise hypothesized that SmashJacker may be related to ChromeLoader based on their similar distribution schemes, but more evidence is needed to solidify the link. In Red Canary’s own observations, we note that SmashJacker and ChromeLoader are often distributed through similar channels and have similar goals of monetizing content via installer files posing as media content.

Browser troubles

During execution, some versions of SmashJacker persist using AppInit DLLs, while others use Windows scheduled tasks. All of the variants Red Canary observed distributed a browser extension for Microsoft Edge and Google Chrome designed to redirect any search queries for common search engines. When performing queries to Google, Yahoo, and others, the browser extension rewrote the submitted query URL, directing the search through an adversary-controlled site such as searchesmia[.]com designed to monetize the search traffic. During the installation process, SmashJacker and similar threats have effectively manipulated Google Chrome’s and Microsoft Edge’s ExtensionInstallAllowList and ExtensionInstallForceList to install browser extensions with minimal interaction from a victim.

SmashJacker is an opportunistic threat, affecting a variety of organizations due to its wide distribution driven by SEO manipulation. While its behavior is not as severe as that of other malware families, a successful SmashJacker attack can be a symptom of larger IT hygiene issues within an organization, such as overly permissive application allowlisting and a lack of policy-based controls on web browsers.