319 Chrome extensions with 13.4 million installs hijacked searches
Socket says operators swapped the default search engine and proxied queries for Bing and Yahoo referral payments; most listings are now gone.
72
Product
Chrome Web Store
- Mentions · 7d1
- Mentions · 30d1
- All mentions5
- First seenAug 12, 2026
- Last mentioned2d ago
Timeline
5 articles · newest firstChrome Store Hosts 'Poper Blocker' Spyware Downloaded by Millions
A Chrome Web Store ad blocker called Poper Blocker exfiltrates sensitive data and was downloaded millions of times.
74
19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto
Socket found 19 malicious Chrome and Edge extensions, active since February 2024, stealing wallet seed phrases and credentials and draining crypto from about 80,000 users.
62
Attackers impersonate popular AI brands to spread malware
Sophos documented 38 MDR cases where attackers impersonated AI brands like Claude and Perplexity to deliver infostealers and backdoors.
52
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
Researchers found 737 Chrome VPN extensions, many impersonating brands like NordVPN, routing roughly 75,000 users' browser traffic through attacker-controlled SOCKS5 proxies.
60
Appears with
- Googlevendor · 3
- Googleorganization · 2
- Socketvendor · 2
- financial services organizationvictim · 1
- AI Sidebarmalware · 1
- DeepSeekai model · 1
- DomainToolsvendor · 1
- Copilotai model · 1
- Predator Searchmalware · 1
- Rust remote access trojanmalware · 1
- Netskopeorganization · 1
- Superiorthreat actor · 1
- ExpressVPNproduct · 1
- ChatGPTai model · 1
- Slackproduct · 1
- SecuryBrowsemalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.