A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo.
A new report by Socket's John Tuckner expands on the researcher's April 2025 discovery of 57 Chrome extensions with 6 million users, adding 264 newly identified add-ons with another 8.7 million users.
"These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID," explained Tuckner.
The extensions, with the full list shared at the bottom of Socket's report, pretend to be PDF converters, manual finders, safe search, and AI search tools. However, for the most part, the extensions simply redirect users' searches through a series of sites until they land on Bing or Yahoo.
Although they are hosted on the Chrome Web Store, Google's official portal for Chrome add-ons, Socket says they are unlisted and don't appear in users' searches on the extension store.
Instead, the extensions are promoted through shady advertisements found on websites.
Tuckner explains that many of these extensions need almost no code to achieve their goal, as Chrome's built-in 'chrome_settings_overrides' setting allows them to replace the default search provider.
One example analyzed in the report includes only a manifest and icons, with no background scripts, content scripts, or requested permissions.
Browser-hijacking extensions like these have long blurred the line between potentially unwanted programs (PUPs) and malware, with BleepingComputer reporting on hundreds of similar extensions over the years.
Risk extends beyond ad fraud
The extensions currently focus on revenue generation through search referrals, passing user searches through an operator-controlled server before they reach Yahoo or Bing.
However, Tuckner warns that the final destination can change at any time without updating the extension, including redirecting users to phishing sites or malicious downloads.
"The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads," explains Tuckner.
An example of this is the Predator Search extension, which redirected Tuckner to four different sites when performing six identical searches.
"Six identical searches sent through its proxy search server ended in four different places: straight to Yahoo with partner tags (hspart=sz&hsimp=yhs-026), a landing page on searchlio.net, a hop through searchtosearch.com to a second results domain (mcftink.com) before Yahoo, and a Cloudflare non-responsive error page," Tuckner reported.
"The extension never changed; the proxy chose each destination as the search came in."
The largest recently active cluster of extensions is "Bing-Search," with 37 extensions and 2.2 million users, often promoted through Bidbrain ads. Another one is the "SecuryBrowse" wave, with 58 extensions and 4.9 million users, promoting security-themed add-ons like Fire Shield, Securify, and WatchTower.
The researcher said most of these extensions had been removed from the Chrome Web Store when the report was published. However, new ones are constantly being added.
Users should uninstall the extensions listed in Socket's report from their web browsers, run a full AV scan on their systems, and avoid downloading unnecessary tools and browser add-ons from unknown publishers.
BleepingComputer has contacted Google for a comment on Socket's findings, but we have not received a response by publication.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report