319 Chrome extensions with 13.4 million installs hijacked searches for ad revenue

A massive search-hijacking campaign has been traced to 319 Chrome extensions with a combined 13.4 million reported installations. The extensions funneled users' searches through tracking servers and earned partner payouts from Bing and Yahoo.

A new report by John Tuckner of Socket builds on his own April 2025 discovery. Back then he found 57 extensions with 6 million users; the new research adds 264 previously unidentified add-ons with another 8.7 million users.

According to Tuckner, the extensions were built by a handful of organized operators working from the same playbook: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect referral payments from Yahoo or Bing under a syndication partner ID.

Disguise and distribution

The extensions posed as PDF converters, manual finders, safe-search utilities, and AI search tools. In practice, most of them simply bounced the query through a chain of sites until it reached Bing or Yahoo.

Although they were hosted on the official Chrome Web Store, the add-ons were unlisted and did not show up in the store's search results. Instead, they were promoted through shady ads on third-party websites.

Pulling this off takes almost no code: Chrome's built-in chrome_settings_overrides setting lets an extension replace the default search provider. One sample analyzed in the report consisted of nothing more than a manifest and icons, with no background scripts, no content scripts, and no requested permissions.

The risk goes beyond ad fraud

For now, the operators profit from search referrals. Tuckner warns, however, that the final destination can be changed at any moment without updating the extension, for instance to send users to phishing sites or malicious downloads. In his words, referral revenue is a profitable watering hole while the proxy operator waits for data to pile up and targets to emerge.

The Predator Search extension illustrates the point. Six identical searches took the researcher to four different places: straight to Yahoo with partner tags, a landing page on searchlio.net, a hop via searchtosearch.com to mcftink.com and then Yahoo, and a Cloudflare error page. "The extension never changed; the proxy chose each destination as the search came in," Tuckner noted.

The largest recently active cluster, Bing-Search, comprises 37 extensions with 2.2 million users, often promoted through Bidbrain ads. Another wave, SecuryBrowse, counts 58 extensions with 4.9 million users and leaned on a security theme with names like Fire Shield, Securify, and WatchTower.

By the time the report was published, most of the extensions had been pulled from the Chrome Web Store, but new ones keep appearing. Users are advised to remove any add-ons on Socket's list, run a full antivirus scan, and avoid installing unnecessary extensions from unknown publishers. Google had not responded to Bleeping Computer's request for comment by publication time.

Source: Bleeping Computer