319 Chrome extensions with 13.4 million installs hijacked searches
Original title: Chrome extensions with 13.4 million installs caught hijacking searches
Socket says operators swapped the default search engine and proxied queries for Bing and Yahoo referral payments; most listings are now gone.
Socket researcher John Tuckner reported 319 Chrome extensions, with a combined 13.4 million reported installations, that redirected searches through operator-controlled servers to earn Bing and Yahoo syndication payments. The set expands an April 2025 finding of 57 extensions with 6 million users by 264 newly identified add-ons and 8.7 million more users. The extensions posed as PDF converters, manual finders, safe-search tools, and AI search tools, and many only used Chrome's chrome_settings_overrides setting. They were unlisted in the Chrome Web Store and promoted through shady website ads. Socket said most had been removed by publication, while new ones keep appearing.
Unconfirmed: Tuckner warns the proxies could later redirect users to phishing or malicious downloads, which has not been confirmed as their current behavior.
- The largest recent cluster, Bing-Search, had 37 extensions and 2.2 million users.
- SecuryBrowse covered 58 security-themed extensions and 4.9 million users.
- Predator Search sent six identical queries to four different destinations.
- Some extensions contained only a manifest and icons, with no extra permissions.
- BleepingComputer had not received a comment from Google by publication.
Impact: User searches redirected through proxies for advertising referral revenue
| Product | Affected |
|---|---|
| Google Chrome | — |
- 1.Uninstall extensions listed in Socket's report.
- 2.Run a full antivirus scan.
- 3.Avoid browser add-ons promoted through unknown publishers or shady ads.
- ATT&CK
- T1176 Browser Extensions
- Vendors
- Products
- ChromeChrome Web Store
- Organizations
- Socket
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | mcftink.com | hop through searchtosearch.com to a second results domain (mcftink.com) before Yahoo, and a Cloudflare non-responsive error page," |
| domain | searchtosearch.com | mp=yhs-026), a landing page on searchlio.net, a hop through searchtosearch.com to a second results domain (mcftink.com) before Yahoo, and |
From the original article
3 min read at bleepingcomputer.com
A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13. 4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.