
319 Chrome extensions with 13.4 million installs hijacked searches
Socket says operators swapped the default search engine and proxied queries for Bing and Yahoo referral payments; most listings are now gone.
6 stories, newest first · one card per story

Socket says operators swapped the default search engine and proxied queries for Bing and Yahoo referral payments; most listings are now gone.

Debugging protocols, in-browser agents and WebMCP can act inside signed-in sessions that logs may attribute to the user.

The decade-long set is linked to about 13.4 million reported users, a cumulative figure rather than current infections.

Extensions redirect user searches via proxies to Yahoo or Bing for referral revenue, exposing queries without invasive scripts.

Socket found 19 malicious Chrome and Edge extensions, active since February 2024, stealing wallet seed phrases and credentials and draining crypto from about 80,000 users.

Nearly 800 typo-squatted npm packages deliver WEL1DROPPER, a cross-platform downloader installing RAT and infostealer payloads on Windows, macOS, Linux.
Today 1.5K readers · 2.4K views · 754 reads · all time 189K views