Those individuals just changed the text to provide instructions for installing their web browser. This was the first clue that the web browser and the search hijackers were connected.ĭigging into those websites itself, Arntz found that whoever designed them had used the same layout that tells users how to install a Chrome extension.

While searching for new variants of an established family of search hijackers, Arntz came across some websites advertising WebNavigator. They are paid by advertisers, who shell out for beneficial placement in the search results for keyword phrases of their choice. Pieter Arntz, malware intelligence researcher with the security firm, explained in a blog post that these search hijackers are all about directing unsuspecting visitors to sponsored ads:Įvery time someone clicks on a sponsored advertisement, the requisite search engine earns money on a pay-per-click basis. However, Malwarebytes analyzed the web browser and found a connection to what’s known as “search hijackers.”

The installation dialog box for WebNavigator.

Malwarebytes reddit 2020