[CLSTR]
API
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

2 clusters · 15 sources · 3 days · First seen · Last updated

Chrome extension search hijacking campaign

Overview

A cybersecurity investigation by Socket has identified a large scale search hijacking campaign involving 319 Google Chrome extensions. These extensions, which have reached approximately 13.4 million installations, often masquerade as legitimate tools such as PDF converters, antivirus software, or AI powered search assistants.

The campaign exploits a native Chrome feature called ‘chrome_settings_overrides’ to discreetly replace the browser’s default search engine. User queries are routed through operator controlled proxy servers before being sent to engines like Bing or Yahoo. This method allows organized actors to intercept data and generate advertising revenue through search syndication and affiliate commissions.

While the primary objective appears to be ad fraud, researchers warn that the infrastructure poses privacy and security risks, as the proxy servers could potentially redirect users to phishing sites or malicious downloads.

Entities

John Tuckner · Google · Socket · Bing · Yahoo

Timeline

  1. [TECHNOLOGY] 2 sources
    Google Chrome extensions affect 13 million users

    Over 13 million Google Chrome users have been affected by 319 extensions that divert search queries through third-party servers to claim affiliate commissions.

  2. [TECHNOLOGY] 13 sources
    Socket identifies 319 Chrome extensions hijacking 13.4 million searches

    Socket researchers found 319 Chrome extensions with 13.4 million installs that hijack searches to generate ad revenue via proxy servers, posing privacy and security risks.

Sources

bitcoinbazis.hu · canaltech.com.br · cyberinsider.com · cybernoz.com · generation-nt.com · hardware.com.br · infoguerra.com.br · it-boltwise.de · jornal24horas.com.br · m3.se · pcforalla.se · pcrevenge.org · phonetoday.it · servicesmobiles.fr · yourlifeupdated.net