Chrome Extensions With 13.4 Million Installs Found Hijacking User Searches for Ad Revenue

A large-scale search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo, according to new research published by the security firm Socket. The findings come from Socket researcher John Tuckner and expand on a discovery first made in April 2025, when 57 Chrome extensions with roughly 6 million users were identified. The updated report adds 264 newly discovered add-ons serving another 8.7 million users. According to Tuckner, the extensions were created by a small number of organized operators following the same playbook: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID. The extensions masquerade as useful tools, presenting themselves as PDF converters, manual finders, safe search utilities, and AI search assistants. In practice, most simply redirect users' searches through a chain of sites until they arrive on Bing or Yahoo. Although hosted on the Chrome Web Store, Google's official marketplace for browser add-ons, Socket says the extensions are unlisted and do not appear in search results on the store. Instead, they are promoted through questionable advertisements placed on websites. The technical barrier to carrying out the scheme is low. Tuckner explained that many of the extensions require almost no code because Chrome's built-in 'chrome_settings_overrides' setting allows them to replace the default search provider. One extension analyzed in the report consisted only of a manifest file and icons, with no background scripts, content scripts, or requested permissions. While the current focus is revenue generation through search referrals, the researcher warned that the infrastructure poses a broader risk. Because searches pass through an operator-controlled server before reaching Yahoo or Bing, the final destination can be changed at any time without updating the extension itself. Tuckner described the referral revenue as a profitable watering hole that allows proxy operators to wait for data to accumulate and targets to surface before redirecting users to phishing pages or malicious downloads. The report cites the Predator Search extension as an example of this flexibility. Six identical searches submitted through its proxy server ended in four different destinations: directly to Yahoo with partner tags, a landing page on searchlio.net, a hop through searchtosearch.com to a second results domain called mcftink.com before reaching Yahoo, and a Cloudflare error page. The extension itself never changed; the proxy selected each destination as the search came in. Among the most active clusters identified are a group called "Bing-Search," comprising 37 extensions with 2.2 million users and often promoted through Bidbrain ads, and the "SecuryBrowse" wave, which includes 58 extensions with 4.9 million users promoting security-themed add-ons such as Fire Shield, Securify, and WatchTower. Tuckner said most of the extensions had been removed from the Chrome Web Store by the time the report was published, but new ones are constantly being added. Browser-hijacking extensions of this kind have long blurred the line between potentially unwanted programs and malware, with hundreds of similar add-ons reported over the years. Users are advised to uninstall any extensions listed in Socket's report, run a full antivirus scan on their systems, and avoid downloading unnecessary tools and browser add-ons from unknown publishers. BleepingComputer contacted Google for comment on the findings but had not received a response by publication.