started · updated
Socket identifies 319 Chrome extensions hijacking 13.4 million searches
A security investigation by Socket has uncovered a massive search-hijacking campaign involving 319 Chrome extensions. These add-ons, which have accumulated approximately 13.4 million installations over the last decade, redirect user queries through operator-controlled proxy servers before sending them to Bing or Yahoo.
The extensions often masquerade as legitimate tools, such as PDF converters, manual finders, safe search utilities, or AI-powered search assistants. By routing traffic through intermediaries, the operators generate advertising revenue via search syndication programs by attaching referral identifiers to the queries.
Technically, the hijack exploits a native Chrome feature called ‘chrome_settings_overrides’, which allows extensions to change the default search engine via the manifest file without requiring additional permissions or executing suspicious background code. This makes the activity difficult to detect through standard permission reviews.
Researchers warn that while the primary goal is ad fraud, the infrastructure poses significant privacy and security risks. Because the proxy servers control the destination of each query, operators could potentially redirect users to phishing sites or malicious downloads. While many identified extensions have been removed from the Chrome Web Store, new variants continue to appear, often promoted through advertisements on third-party websites.
Entities
Bing · Google · Google Chrome · John Tuckner · Microsoft · Socket · Yahoo
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 5 SOURCES] The extensions are often promoted through advertisements on websites rather than appearing in Chrome Web Store searches. cybernoz.com · www.pcforalla.se · www.it-boltwise.de · www.phonetoday.it · canaltech.com.br
- [● 3 SOURCES] Operators could potentially use the proxy infrastructure to redirect users to phishing or malware sites. www.pcforalla.se · www.generation-nt.com · canaltech.com.br
- [● 3 SOURCES] The extension Predator Search was observed sending identical searches to four different destinations. cyberinsider.com · www.phonetoday.it · canaltech.com.br
- [● 12 SOURCES] Socket identified 319 Chrome extensions involved in a search-hijacking campaign. cybernoz.com · www.pcforalla.se · pcrevenge.org · cyberinsider.com · www.hardware.com.br · +7 more
- [● 5 SOURCES] The extensions can change the default search engine without requiring background scripts or content scripts. cybernoz.com · pcrevenge.org · www.hardware.com.br · totalsecurity.com.br · canaltech.com.br
- [● 12 SOURCES] The extensions have a combined total of approximately 13.4 million installations. cybernoz.com · www.pcforalla.se · pcrevenge.org · cyberinsider.com · www.hardware.com.br · +7 more
- [● 12 SOURCES] The hijacking mechanism utilizes the Chrome ‘chrome_settings_overrides’ setting. cybernoz.com · www.pcforalla.se · pcrevenge.org · cyberinsider.com · www.hardware.com.br · +7 more
- [● 12 SOURCES] The extensions redirect searches through proxy servers to generate revenue from Bing and Yahoo. cybernoz.com · www.pcforalla.se · pcrevenge.org · cyberinsider.com · www.hardware.com.br · +7 more