Forestab Browser Extension

While investigating suspicious websites, our team of researchers came across the Forestab browser extension. Marketed as a tool to enhance users' browser experience with nature-themed wallpapers, our analysis revealed that it actually functions as a browser hijacker.

Upon a thorough examination, we determined that Forestab manipulates browser settings to further the agenda of promoting the phony search engine, search.forestab.com, through redirects. Additionally, this seemingly innocuous extension engages in intrusive behavior by monitoring users' online browsing activities.

Browser hijackers operate by overwriting default browser settings, including search engines, homepages, and new tab/window URLs, with links to endorsed websites. Forestab follows this same pattern by altering browser settings. Consequently, once this extension is installed, any web searches conducted through the URL bar or new browser tabs/windows will lead to redirects to the search.forestab.com website.

Importantly, it should be noted that browser hijackers might possess the capability to obstruct access to removal-related settings and potentially reverse user-initiated modifications.

Counterfeit search engines generally lack the capacity to generate genuine search results, often redirecting users to legitimate ones instead. In the case of search.forestab.com, the redirection eventually leads to the Google search engine (google.com). However, it's worth acknowledging that this redirection destination may vary based on factors like user location, which can influence the redirection behavior.

Beyond its browser-altering activities, Forestab also exhibits the ability to collect user data. This aligns with the typical behavior of browser hijacking software, which tends to amass a range of information, including visited URLs, viewed pages, search queries, cookies, login credentials, personal identifiers, and even financial data. The aggregated data can then be exploited for financial gain through its sale to third parties.

What Are Browser Hijackers?

Browser hijackers are malicious software or extensions that modify the settings of a web browser without the user's consent or knowledge. These unauthorized changes can include altering the default search engine, homepage, new tab settings, and other browser preferences. Browser hijackers often aim to redirect users to specific websites, inject unwanted advertisements, and collect user data for various purposes.

Here are some key characteristics and behaviors of browser hijackers:

• Unauthorized Modifications: Browser hijackers change browser settings to redirect users to specific websites, often for promotional or malicious purposes. These changes are usually made without the user's explicit permission.
• Search Engine Redirection: One common trait of browser hijackers is redirecting users' searches to a different search engine or a custom search page that might provide altered search results or display ads.
• Homepage and New Tab Changes: Browser hijackers can alter the default homepage and the behavior of new tabs, forcing users to visit specific websites upon opening their browser.
• Unwanted Advertisements: Many browser hijackers inject intrusive advertisements into web pages, pop-ups, and banners, disrupting the user's browsing experience and potentially leading to unsafe websites.
• Data Collection: Browser hijackers often collect user data, such as browsing history, search queries, visited websites, and even personal information. This data can be used for targeted advertising or sold to third parties.
• Distribution: Browser hijackers can be distributed through various methods, including software bundling (where they are included with legitimate software installations), deceptive advertisements, malicious downloads, and compromised websites.
• Negative Impact on Performance: Browser hijackers can slow down your browser's performance and overall system speed due to the additional processes they run and the ads they display.
• Privacy Concerns: Because browser hijackers collect user data without explicit consent, they raise privacy concerns. Users may become vulnerable to identity theft, phishing attacks, and other cyber threats.