More than 300 Chrome extensions with a combined 13.4 million installations have been caught hijacking users' searches, redirecting them through tracking servers to generate advertising revenue from Bing and Yahoo, according to a report from Socket.
The report by Socket's John Tuckner expands on an April 2025 discovery of 57 extensions with 6 million users, adding 264 newly identified add-ons with another 8.7 million users. The 319 extensions pretend to be PDF converters, manual finders, safe search tools, and AI search tools, but most simply redirect users' searches through a series of sites until they land on Bing or Yahoo.
"These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID," Tuckner said.
Socket says the extensions are unlisted on the Chrome Web Store and do not appear in users' searches on the extension store, instead being promoted through shady advertisements on websites. Tuckner said some require almost no code, as Chrome's built-in 'chrome_settings_overrides' setting allows them to replace the default search provider.
Tuckner warned that the risk extends beyond ad fraud. The final destination can change at any time without updating the extension, potentially redirecting users to phishing sites or malicious downloads. "The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads," he said.
An example was the Predator Search extension, which redirected Tuckner to four different sites when performing six identical searches. "Six identical searches sent through its proxy search server ended in four different places: straight to Yahoo with partner tags (hspart=sz&hsimp=yhs-026), a landing page on searchlio.net, a hop through searchtosearch.com to a second results domain (mcftink.com) before Yahoo, and a Cloudflare non-responsive error page," Tuckner reported. "The extension never changed; the proxy chose each destination as the search came in."
The largest recently active cluster was the "Bing-Search" group with 37 extensions and 2.2 million users. Another was the "SecuryBrowse" wave with 58 extensions and 4.9 million users that promoted security-themed add-ons like Fire Shield, Securify, and WatchTower. Tuckner said most of these extensions had been removed from the Chrome Web Store when the report was published, but new ones are constantly being added.
BleepingComputer contacted Google for comment but did not receive a response by publication.
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.
Installs of Chrome extensions in search-hijacking campaign
million installs
The sum of initial and new discoveries (14.7M) exceeds the reported total (13.4M), likely due to rounding or overlapping extensions. Source: Socket/John Tuckner via BleepingComputer
§
Analysis
Why This Matters
The scale of the campaign affects millions of users who may have unknowingly installed these extensions on their browsers.
Beyond ad fraud, the operators could redirect users to phishing or malware sites at any time without updating the extension.
The method using Chrome's built-in settings makes detection difficult and allows simple extensions to hijack searches with minimal code.
Background
Browser-hijacking extensions have long been a problem, blurring the line between potentially unwanted programs and malware. Chrome extensions are distributed through the Chrome Web Store, and while Google removes malicious ones, bad actors constantly add new ones, often promoting them through deceptive advertisements on third-party sites.
Key Perspectives
What to Watch
Whether Google strengthens its review process for unlisted extensions or changes the chrome_settings_overrides setting that enables this hijacking.
The emergence of new clusters of extensions promoted through similar shady ad campaigns.
Potential for the proxy operators to pivot from ad fraud to more malicious activities such as credential theft or ransomware distribution.
12 claims in this story checked against 1 source: 11 supported.
Show each claim
SupportedThe headline says 319 Chrome extensions with 13.4 million installs were caught hijacking searches.BleepingComputer: “Chrome extensions with 13.4 million installs caught hijacking searches. A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches”
Partly supportedThe summary says Socket researcher John Tuckner warned that extensions disguised as PDF converters and AI tools redirect queries for ad revenue and could send users to phishing sites.BleepingComputer: “The extensions ... pretend to be PDF converters, manual finders, safe search, and AI search tools.”
SupportedThe opening says 319 extensions with 13.4 million installations redirected searches through tracking servers to generate ad revenue from Bing and Yahoo, according to Socket.BleepingComputer: “A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo.”
SupportedThe report builds on an April 2025 discovery of 57 extensions with 6 million users, adding 264 newly identified add-ons with another 8.7 million users.BleepingComputer: “A new report by Socket's John Tuckner expands on the researcher's April 2025 discovery of 57 Chrome extensions with 6 million users, adding 264 newly identified add-ons with another 8.7 million users.”
SupportedTuckner said: “These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID,”BleepingComputer: “"These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID," explained Tuckner .”
SupportedTuckner warned that destinations can change without an extension update and could lead users to phishing sites or malicious downloads.BleepingComputer: “However, Tuckner warns that the final destination can change at any time without updating the extension, including redirecting users to phishing sites or malicious downloads.”
SupportedTuckner said: “The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads,”BleepingComputer: “"The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads," explains Tuckner.”
SupportedPredator Search sent Tuckner to four different sites in six identical searches.BleepingComputer: “An example of this is the Predator Search extension, which redirected Tuckner to four different sites when performing six identical searches.”
SupportedTuckner reported: “Six identical searches sent through its proxy search server ended in four different places: straight to Yahoo with partner tags (hspart=sz&hsimp=yhs-026), a landing page on searchlio.net, a hop through searchtosearch.com to a second results domain (mcftink.com) before Yahoo, and a Cloudflare non-responsive error page,”BleepingComputer: “"Six identical searches sent through its proxy search server ended in four different places: straight to Yahoo with partner tags (hspart=sz&hsimp=yhs-026), a landing page on searchlio.net, a hop through searchtosearch.com to a second results domain (mcftink.com) before Yahoo, and a Cloudflare non-responsive error page,"”
SupportedTuckner said: “The extension never changed; the proxy chose each destination as the search came in.”BleepingComputer: “"The extension never changed; the proxy chose each destination as the search came in."”
SupportedThe largest recently active cluster was the Bing-Search group, with 37 extensions and 2.2 million users.BleepingComputer: “The largest recently active cluster of extensions is "Bing-Search," with 37 extensions and 2.2 million users”
SupportedMost extensions had been removed from the Chrome Web Store when the report was published, but new ones were constantly being added.BleepingComputer: “The researcher said most of these extensions had been removed from the Chrome Web Store when the report was published. However, new ones are constantly being added.”