319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through operator-controlled tracking servers to generate advertising revenue from Bing and Yahoo.
How the extensions hijacked browser search
Socket researcher John Tuckner expands on his April 2025 work to show a coordinated model: extensions quietly replace the browser's default search engine and route every query through a proxy under the operator's control. "These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID," Tuckner wrote.
Technically, many of the add‑ons used Chrome's built‑in chrome_settings_overrides setting to switch the default search provider. That allowed even minimal extensions — in one example, an add‑on that contained only a manifest and icons and requested no permissions — to achieve the redirection without background or content scripts.
"Bing-Search" and "SecuryBrowse": the largest clusters
Tuckner identified distinct waves of activity. The largest recently active cluster, labeled "Bing-Search," comprised 37 extensions and about 2.2 million users; those were often promoted through Bidbrain ads. A separate wave, called "SecuryBrowse," included 58 extensions and roughly 4.9 million users promoting security‑themed add‑ons with names such as Fire Shield, Securify, and WatchTower.
Socket's wider update added 264 newly identified add‑ons to an earlier list of 57, bringing the total reported installations to 13.4 million (6 million from the April 2025 set, plus 8.7 million in newly identified extensions). The full list of flagged extensions was shared at the bottom of Socket's report.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageExamples and erratic redirection behavior
The extensions disguised themselves as legitimate utilities — PDF converters, manual finders, safe search tools and AI search helpers — but "for the most part" they simply redirected users' queries through chains of sites before landing on Bing or Yahoo.
Tuckner demonstrated that the proxy could choose different destinations for identical searches without any change to the installed extension. One analyzed add‑on, Predator Search, sent six identical searches through its proxy and produced four different outcomes: a direct landing on Yahoo with partner tags (hspart=sz&hsimp=yhs-026), a landing page on searchlio.net, a hop via searchtosearch.com to a second results domain (mcftink.com) before Yahoo, and a Cloudflare non‑responsive error page. "The extension never changed; the proxy chose each destination as the search came in," Tuckner reported.
Risk extends beyond ad fraud
At present, the primary monetization appears to be partner referral payments for search results. But Tuckner warned that the final destination of queries can change at any time without updating the extension. "The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads," he said.
Browser‑hijacking extensions have been a recurrent problem: BleepingComputer has reported on hundreds of similar extensions over the years. Socket found that, although these extensions were hosted on the Chrome Web Store, they were unlisted and did not appear in in‑store searches; instead they were promoted through advertisements on websites.
What this means for end users, security teams, and Google
- End users: Socket and BleepingComputer recommend uninstalling any extensions listed in Socket's report, running a full antivirus scan, and avoiding downloads of unnecessary browser tools from unknown publishers.
- Security teams and technologists: the operation demonstrates how a simple chrome_settings_overrides configuration can be abused at scale to steal referral revenue and, potentially, to pivot to phishing or malicious downloads without changing the installed code.
- Google and platform operators: Socket reported that most of the flagged extensions had been removed from the Chrome Web Store when the report was published; BleepingComputer contacted Google for comment but had not received a response by publication.
The campaign illustrates a currently low‑risk, high‑scale fraud model that can be repurposed quickly. Operators used minimal code and ad channels to reach millions; the proxy layer, not the extension itself, controlled where searches ultimately landed. Until users remove flagged extensions and platform controls prevent this pattern, the proxy could be turned toward phishing or malware distribution at any time.
