A massive search-hijacking campaign involving 319 Google Chrome extensions has been discovered, with the malicious add-ons collectively reporting approximately 13.4 million installations. The extensions secretly redirect users’ searches through tracking servers to generate advertising revenue from Microsoft Bing and Yahoo.
The discovery comes from security researcher John Tuckner of Socket, who expanded on his earlier investigation from April 2025, when he identified 57 Chrome extensions with approximately six million installations. The latest research uncovered another 264 extensions with an additional 8.7 million reported installations.
According to Tuckner, the extensions are operated by several organized groups using similar techniques to take control of users’ default browser search engines. Instead of sending searches directly to the selected search provider, the extensions route queries through operator-controlled proxy servers before redirecting users to Bing or Yahoo.
The operators reportedly generate revenue through advertising referral partnerships by attaching specific partner identifiers to search requests.
Many of the extensions disguise themselves as legitimate browser utilities, including PDF converters, instruction manuals, safe-search tools and AI-powered search assistants. Although they are available through Google’s official Chrome Web Store, many are unlisted and cannot easily be discovered through normal searches on the extension marketplace.
Instead, users are often encouraged to install them through questionable advertisements displayed on external websites.
One concerning aspect of the campaign is that these extensions require very little code to hijack browser searches. Researchers found that Chrome’s built-in chrome_settings_overrides feature can be used to replace the default search provider without requiring extensive background scripts, content scripts or additional permissions.
In one example examined by Socket, an extension contained little more than a manifest file and icons, yet could still change the browser’s search settings.
Although the extensions primarily appear designed to generate advertising revenue, researchers warn that the same infrastructure could potentially be used for more dangerous activities.
Because search requests pass through servers controlled by the extension operators, attackers can change the final destination without releasing an updated browser extension. This means users could eventually be redirected to phishing websites, fraudulent pages or malicious downloads.
Tuckner demonstrated this behavior using an extension called Predator Search. During testing, six identical search queries were redirected to four different destinations. Some searches went directly to Yahoo with advertising referral identifiers, while others passed through websites such as searchlio.net, searchtosearch.com and mcftink.com. One request also ended at an unresponsive Cloudflare error page.
The researcher noted that the extension itself remained unchanged throughout the tests, suggesting that the proxy server controlled where individual searches were sent.
Two particularly large groups identified in the investigation include the Bing-Search and SecuryBrowse campaigns. The Bing-Search cluster contains 37 extensions with approximately 2.2 million reported installations and has reportedly been promoted through Bidbrain advertisements.
The SecuryBrowse campaign includes 58 extensions with around 4.9 million reported installations. These add-ons use security-themed names such as Fire Shield, Securify and WatchTower to appear trustworthy to potential users.
According to Socket, most of the identified extensions had already been removed from the Chrome Web Store when the research was published. However, new extensions using similar techniques continue to appear.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Users are advised to review their installed Chrome extensions and remove any suspicious add-ons identified in Socket’s research. They should also run a full antivirus scan and avoid installing unnecessary browser extensions from unfamiliar publishers.
