319 Chrome Extensions Hijack Searches Affecting 13.4M Users
Original title: 319 Chrome Extensions Found Hijacking Searches, Affecting 13.4 Million Users
Extensions redirect user searches via proxies to Yahoo or Bing for referral revenue, exposing queries without invasive scripts.
A network of 319 browser extensions has hijacked searches for roughly 13.4 million users over a decade. Marketed as PDF converters or AI tools, they abuse Chrome's search override setting to route queries through operator servers before Yahoo or Bing. Most extensions are unlisted in the store and linked to Intango LTD and SecuryBrowse. Activity dates to 2016 with referral-tagged traffic only; malicious payload redirection remains unconfirmed.
- Uses chrome_settings_overrides.search_provider setting
- 264 new extensions affect 8.7 million users
- Domains include search.safesearchgame[.]com
- No background workers or extra permissions
- Traffic tracked via shared ad accounts
Impact: Search query interception by extensions
- 1.Remove unfamiliar extensions
- 2.Check default search engine
- 3.Review chrome_settings_overrides
- Products
- Chrome
- Victims
- 13.4 million users
- Organizations
- Intango LTDSecuryBrowseSocket.dev
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | extension-search.online | termediary Domain mcftink[.]com Intermediate results Domain extension-search[.]online Historical hijacker Tracking parameters hspart=sz&hsimp=y |
| domain | mcftink.com | on Domain searchtosearch[.]com Redirect intermediary Domain mcftink[.]com Intermediate results Domain extension-search[.]online His |
| domain | safesearchgame.com | cfoohjiicbelloepgcomekdknchjh Predator Search Domain search.safesearchgame[.]com Search proxy Domain suggest.safesearchgame[.]com Query su |
| domain | searchlio.net | omain suggest.safesearchgame[.]com Query suggestions Domain searchlio[.]net Observed destination Domain searchtosearch[.]com Redirect |
| domain | searchtosearch.com | gestions Domain searchlio[.]net Observed destination Domain searchtosearch[.]com Redirect intermediary Domain mcftink[.]com Intermediate r |
From the original article
3 min read at cybersecuritynews.com
A network of 319 browser extensions has been linked to search hijacking affecting roughly 13. 4 million users over a decade. Marketed as PDF converters, manual finders, safe search tools, and AI search helpers, these extensions redirect queries through operator-controlled servers before sending users to Yahoo or Bing.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.