Overview
Researchers at Socket report a large search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installs. The extensions redirect users' searches through operator-controlled proxy and tracking servers before they reach Bing or Yahoo, generating advertising revenue for the operators.
The report, titled "searchjacked," was written by John Tuckner and expands on his April 2025 findings. That earlier batch covered 57 extensions with about 6 million users. The new report adds 264 extensions with about 8.7 million users.
How It Works
- Extensions use Chrome's
chrome_settings_overridessetting to replace the default search provider, so many need almost no code. One example is only a manifest and icons, with no scripts or requested permissions. - Searches pass through proxy servers, and operators collect referral payments from Yahoo or Bing through a syndication partner ID.
- They pose as PDF converters, manual finders, safe-search tools, and AI search tools.
- They are published on the Chrome Web Store as unlisted, so they do not appear in store search, and are pushed through shady website ads.
Beyond Ad Fraud
The proxy decides the final destination, so it can change without any extension update. That could send users to phishing pages or malicious downloads. In a test of the Predator Search extension, six identical searches ended at four different destinations.
Major Clusters
| Cluster | Extensions | Users | Notes |
|---|---|---|---|
| Bing-Search | 37 | ~2.2M | Promoted through Bidbrain ads; the largest recently active cluster |
| SecuryBrowse | 58 | ~4.9M | Security-themed add-ons such as Fire Shield, Securify, and WatchTower |
Most of the extensions had been removed from the Chrome Web Store when the report was published, but new ones keep appearing. Google had not responded to BleepingComputer's request for comment.
Recommendations
- Uninstall any extension listed in Socket's report and run a full antivirus scan.
- Check your browser's default search engine setting and reset it if it was changed.
- Install extensions only from known publishers, and remove ones you do not need.
- Enterprises should enforce an extension allowlist through browser management policy.