A large-scale Chrome extension campaign used 319 browser add-ons with a reported 13.4 million total installs to hijack users’ searches, route queries through tracking servers and generate advertising referral revenue from Bing and Yahoo. A new report from Socket researcher John Tuckner expands on an earlier investigation and warns that the same infrastructure could also be used to redirect users to phishing pages or malicious downloads.
Tuckner’s report builds on the 57 Chrome extensions with 6 million users that he identified in April 2025. It adds 264 newly identified extensions with 8.7 million users.
“These extensions were created by a small group of organized operators working on the same idea: covertly hijacking the browser’s default search engine, routing every query through a dubious proxy server, and collecting partner referral fees from Yahoo or Bing under the syndication partner ID,” Tuckner explained.
Chrome extensions disguised as useful tools
The complete list of extensions is included at the end of Socket’s report. The add-ons masquerade as PDF converters, instruction finders, safe-search tools and AI search utilities. In many cases, however, their primary function is to redirect searches through several websites before eventually sending users to Bing or Yahoo.
The extensions are hosted on the Chrome Web Store, Google’s official marketplace for Chrome add-ons. Socket said they do not appear to be listed or discoverable through normal searches in the store. Instead, operators promote them through questionable advertisements on websites.
Many of the extensions require very little code to hijack searches. They can replace Chrome’s default search provider using the browser’s built-in chrome_settings_overrides setting.
One extension examined in the report contained only a manifest and an icon. It had no background scripts, content scripts or requested permissions.
Browser hijacking extensions have long occupied the uncertain boundary between potentially unwanted programs (PUPs) and malware. BleepingComputer has reported on hundreds of similar extensions over the years.
Search hijacking could enable phishing attacks
At present, the extensions appear focused on generating revenue from search referrals. Users’ queries pass through servers controlled by the operators before reaching Yahoo or Bing, allowing the operators to collect referral fees.
However, Tuckner warned that the final destination can be changed at any time without updating the extension. Operators could redirect users to phishing websites or pages hosting malicious downloads.
“Search referral revenue is a lucrative watering hole, but proxy operators can accumulate data and wait for targets to surface before redirecting them to malicious search results or landing pages for phishing or other malicious downloads,” Tuckner explained.
The Predator Search extension illustrates how these redirects can vary. During testing, six identical searches submitted through the extension sent Tuckner to four different destinations.
“Six identical searches submitted through a proxy search server ended up in four different places: a direct submission to Yahoo with a partner tag (hspart=sz&hsimp=yhs-026), a landing page on searchlio.net, a hop through searchtosearch.com to Yahoo’s previous second results domain (mcftink.com), and an unresponsive error page on Cloudflare,” Tuckner reported.
“The extension number was never changed. The proxy selected the respective destination when the search came in.”
Millions of users affected across extension groups
The largest cluster of recently active extensions is called “Bing-Search.” It includes 37 extensions with 2.2 million users and was frequently promoted through Bidbrain advertisements.
A second group, SecurityBrowse, includes 58 extensions with 4.9 million users. It promotes security-themed add-ons such as Fire Shield, Securify and WatchTower.
Researchers said most of the extensions had been removed from the Chrome Web Store by the time the report was published. However, new extensions are continually being added.
Users should uninstall any extensions listed in Socket’s report, run a full antivirus scan on their systems and avoid downloading unnecessary browser tools or add-ons from unknown publishers.
BleepingComputer contacted Google for comment on Socket’s findings but did not receive a response before publication.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com