Google Chrome extensions intercepted searches of 13.4 million users

A cybersecurity investigation has identified 319 malicious Google Chrome extensions installed by approximately 13.4 million users worldwide. These extensions, which masqueraded as useful tools such as PDF converters, search engines, or browser enhancements, functioned by altering default search settings without user consent.

The mechanism involved routing search queries through servers controlled by the operators before directing them to legitimate engines like Yahoo or Bing. This allowed the operators to collect data on user interests and browsing habits while generating revenue through referral traffic. While many queries resulted in authentic search results, researchers warned that these extensions could also redirect users to fraudulent websites designed to steal passwords and personal data or distribute malware.

Specific tools identified in the report include Safe Web Search, PDF Manual Finder, Safe Game Search, Predator Search, Fire Shield, Wise Ghost, Securify, Protecto, and WatchTower. The investigation noted that even when certain extensions are removed from the Chrome Web Store, new domains and mechanisms frequently emerge to attract users.