Loading threat actor…
Intango LTD is an operator associated with advertising-driven browser search hijacking through Chrome extensions. Approximately 111 extensions and 2.2 million installs have been linked to the company. These figures represent attributed installations rather than a verified count of currently affected users. Its extension cluster forms part of a broader search-monetization ecosystem involving multiple distinct operators. The activity uses extensions marketed as useful search and document utilities to replace Chrome’s default search provider through browser manifest settings. Searches pass through operator-controlled intermediaries before being forwarded to services such as Yahoo or Bing. Search-syndication identifiers credit referral traffic to operators, generating advertising revenue. This architecture also gives intermediaries visibility into potentially sensitive search queries and server-side control over subsequent destinations without requiring invasive scripts or broad extension permissions. Distribution across the associated ecosystem relies heavily on paid advertisements and promotional landing pages, with many extensions available through direct Chrome Web Store links but absent from normal store searches. The established activity centers on search redirection and advertising monetization; phishing delivery and malicious-payload distribution have not been confirmed.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 indicators attributed to this actor. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.