Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

319 Chrome extensions hijacked searches for 13.4 million installs

4 sources · 4 articlesFirst reported Updated ()1
What's new

October 30: Malwarebytes says queries often carry a unique identifier, ads used Google Ads and a landing page, and users should check extensions and Socket’s list.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Most of 319 search-proxying Chrome extensions totaling 13.4 million reported installs are gone, but new ones still appear.

Socket researcher John Tuckner reported 319 Chrome extensions that replace the default search provider and proxy queries through operator servers to earn Bing and Yahoo referral payments. The set has a combined 13.4 million reported installations; GBHackers says that figure is cumulative reported users, not current infections. Marketed as PDF converters, manual finders, safe-search tools, and AI tools, many used only chrome_settings_overrides.search_provider and requested no sensitive permissions. Clusters are linked to Intango LTD and SecuryBrowse, with activity tracked since 2016. Malicious downloads and phishing remain unconfirmed. Most listings were unlisted and had been removed by publication, while new ones keep appearing; Google had not commented.

Key facts
  • Expands an April 2025 set of 57 extensions and 6 million users by 264 add-ons and 8.7 million users.
  • Intango LTD linked to about 111 extensions and 2.2 million installs.
  • SecuryBrowse linked to 58 extensions and about 4.9 million reported users.
  • Bing-Search cluster: 37 extensions and 2.2 million users.
  • Predator Search, listed with 50,000 users, sent identical queries to different destinations.
  • Socket found no evidence proxies led to phishing or malware pages.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • GBHackersTreats 13.4 million as cumulative reported users, not current infections, and gives Intango counts.
  • BleepingComputerMost listings removed by publication; new ones appear; Google had not commented.
  • Malwarebytes LabsUnique query identifiers, Google Ads promotion, and user cleanup guidance.
  • Cyber Security NewsNames shared ad accounts and search.safesearchgame[.]com among operator domains.
Vendors
Google
Products
ChromeGoogle AdsYahooBingChrome Web Store
Malware
Predator SearchBing-SearchSecuryBrowse
Victims
13.4 million users
Organizations
SocketIntango LTDSecuryBrowseSocket.dev

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Cyber Security NewsFirst report

    319 Chrome Extensions Hijack Searches Affecting 13.4M Users

    Extensions redirect user searches via proxies to Yahoo or Bing for referral revenue, exposing queries without invasive scripts.

  2. · 1d ago GBHackers

    319 Chrome extensions override default search without extra permissions

    The decade-long set is linked to about 13.4 million reported users, a cumulative figure rather than current infections.

  3. · 1d ago BleepingComputer

    319 Chrome extensions with 13.4 million installs hijacked searches

    Socket says operators swapped the default search engine and proxied queries for Bing and Yahoo referral payments; most listings are now gone.

  4. · 5h ago Malwarebytes Labs

    Fake PDF and search tools hijacked searches for 13.4 million Chrome users

    Socket tied 319 mostly unlisted Chrome Web Store extensions, promoted by ads, to query proxying toward Yahoo or Bing.