Searchjack is a long-running browser-extension search-hijacking campaign. Ad-tech companies, search-syndication resellers and anonymous operators publish large numbers of thin, often unlisted extensions under cheaply disposable themes such as "safe search", "PDF finder", "manual search", maps, package tracking and "AI search". They push installs through low-quality pop-up and search advertising. Once installed, the extensions override the browser's default search provider, often with no code beyond a manifest setting. They send every query through operator-controlled proxy servers that log searches, attach persistent install identifiers, and choose a destination on each request. Searches are often forwarded to Yahoo or Bing search results under syndication partner IDs that earn the operator a share of ad revenue. Because routing is decided server-side, operators could possibly redirect selected searches, users or regions to phishing pages, fake results or malware lures without updating the extension.