Beware of the Space Backgrounds Pictures Browser Hijacker

During our examination of deceptive web pages, our team made a significant discovery regarding the "Space backgrounds pictures" browser extension. This extension is marketed as a tool that offers attractive space-themed wallpapers for browsers.

However, our analysis revealed that Space backgrounds pictures is, in fact, a browser hijacker. Its primary purpose is to modify browser settings, leading to frequent redirects to the spacenewtab.com fake search engine.

Browser hijackers typically manipulate browser settings, including homepages, default search engines, and new tab/window URLs, to promote specific websites.

The Space backgrounds pictures extension follows the same pattern by altering these settings. Consequently, with this extension installed, whenever users open new browser tabs/windows or perform search queries in the URL bar, they are redirected to the spacenewtab.com website.

It's important to note that browser hijackers often employ persistence techniques to make their removal challenging and prevent users from restoring their browsers to their original state.

Fake search engines, such as spacenewtab.com, usually fail to provide reliable search results. Instead, they frequently redirect users to legitimate search engines like Google, Bing, or Yahoo. However, during our research, we observed that spacenewtab.com redirected to another illegitimate search engine called nearbyme.io. Although this site generates search results, they are often inaccurate and include sponsored content, untrustworthy information, deceptive content, and potentially malicious elements.

Furthermore, Space backgrounds pictures has invasive tracking capabilities. It spies on users' browsing activities, collecting various information of interest, such as visited URLs, viewed webpages, search queries, internet cookies, usernames, passwords, personally identifiable information, financial data, and more. This gathered data can then be shared with or sold to third parties, compromising user privacy and security.

What Are Rogue Browser Extensions and Browser Hijackers?

Rogue browser extensions and browser hijackers are types of malicious software that affect web browsers and interfere with users' browsing experiences. Here's an explanation of each:

Rogue Browser Extensions:
Rogue browser extensions are deceptive or malicious software extensions/add-ons/plugins that can be installed in web browsers. These extensions often masquerade as useful tools or enhancements, such as ad blockers, download managers, or productivity utilities. However, once installed, they may engage in unwanted activities without the user's consent or knowledge.
Rogue browser extensions can exhibit various malicious behaviors, including:

• Injecting unwanted advertisements into web pages.
• Modifying search results to promote specific websites or products.
• Collecting user browsing data and personal information without consent.
• Redirecting users to malicious websites.
• Altering browser settings or hijacking the browser's functionality.

These extensions are typically distributed through deceptive marketing techniques, bundled with freeware or shareware, or offered on unofficial or untrustworthy extension stores. Once installed, they can be challenging to remove and may require specialized tools or instructions.

Browser Hijackers:
Browser hijackers are a specific type of rogue software that takes control of a user's web browser and manipulates its settings. They alter the browser's homepage, default search engine, and new tab/window URLs to redirect users to unwanted or malicious websites.
Common behaviors exhibited by browser hijackers include:

• Changing the default search engine to a fake or low-quality search provider.
• Redirecting searches to sponsored or irrelevant websites.
• Displaying excessive and intrusive advertisements.
• Modifying browser settings without user consent.
• Tracking browsing activity and collecting personal information.

Browser hijackers often aim to generate revenue for their creators through forced advertisement views, affiliate marketing schemes, or by collecting user data for targeted advertising. They can be distributed through software bundling, deceptive downloads, or infected websites.