Security firm Socket published research exposing 319 browser add-ons engaged in Chrome search hijacking, redirecting web queries from 13.4 million installations to claim partner advertising revenue [1]. The add-ons quietly replaced default search settings, sending queries through proxy servers to collect referral fees from Yahoo and Bing. Cybersecurity researcher John Tuckner identified the campaign after tracking an earlier wave of search manipulators, expanding Socket’s investigation into how unverified add-ons compromise popular browsers [2]. The scheme shows how unlisted browser add-ons exploit standard configuration settings to monetize daily web searches [1].
Scale of the Chrome Search Hijacking Campaign
The findings expand significantly on earlier tracking by Socket, which documented 57 malicious add-ons and six million users in April 2025 before identifying hundreds of additional variants. Tuckner added 264 newly identified add-ons with an additional 8.7 million users to the investigation, bringing the total footprint to 319 extensions [2]. While combined downloads exceed 13.4 million across both reports, the underlying network relies on a small group of coordinated syndicates [1]. According to Tuckner, “These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser’s default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID” [2].
The malicious add-ons pretend to be everyday file tools to entice people seeking quick utilities [1]. Their web listings describe them as PDF converters, manual finders, AI search helpers, or safe search filters. But they simply redirect search queries rather than offering useful features [2]. Most victims see normal Bing or Yahoo results, so they don’t suspect any tampering [1].
Distribution tactics also disguise the campaign from normal scrutiny in the public store [1]. Although the add-ons live on the Chrome Web Store, Socket found that operators kept them unlisted so they wouldn’t appear in store search results or draw community scrutiny. Users found them through shady web advertisements spread on third-party sites [2]. Unlisted hosting helped the syndicates avoid early user reviews while pulling in millions of installations [1].
How the Extensions Override Browser Defaults
To take control, the add-ons use Chrome’s built-in chrome_settings_overrides feature instead of complex exploits. This setting lets developers replace default search providers or homepages without triggering security alerts [2]. Because Chrome permits these changes by design, the extensions avoid requesting high-level permissions [1].
One sample analyzed by John Tuckner consisted only of a manifest and basic icons. It contained no background scripts, no content scripts, and requested zero permissions. The manifest simply designated an outside server as the search provider, routing address bar searches to the proxy [2]. Security risks in browser add-ons vary in scope; while earlier incidents like Twitch extension account token exposures leaked credentials from thousands of accounts, search hijacking schemes operate silently across millions of daily queries. The bare structure makes automated store detection difficult [1].
Coverage by BleepingComputer observed that these add-ons sit between potentially unwanted programs (PUPs) and malware. They don’t install system backdoors, but they intercept browsing habits without informed consent [2]. Scott Younker reported for Tom’s Guide that proxy servers capture search queries directly from Chrome [1].
Proxy Routing and Predator Search Tests
Financial gain from advertising syndication fuels this entire operation [1]. When an infected user enters a query into Chrome, the browser routes the request to an operator-controlled proxy instead of Google, attaching commercial tracking tags along the way [2]. The proxy server attaches partner tracking codes, sends the query to Bing or Yahoo, and collects referral fees for every search result page generated across infected installations [1]. By steering traffic through their affiliate IDs, the syndicates siphon steady payments from major advertising networks [2].
To evaluate how traffic routing works in practice, Tuckner tested the Predator Search extension. He ran six identical search queries through the proxy server and watched where they landed in real time. Even though the client extension remained unchanged, the proxy routed the queries to four different destinations. Tuckner explained, “Six identical searches sent through its proxy search server ended in four different places: straight to Yahoo with partner tags (hspart=sz&hsimp=yhs-026), a landing page on searchlio.net, a hop through searchtosearch.com to a second results domain (mcftink.com) before Yahoo, and a Cloudflare non-responsive error page”. He added, “The extension never changed; the proxy chose each destination as the search came in” [2]. This test confirmed that remote servers direct users dynamically [1].
Because routing decisions happen on the server, operators can modify destinations without pushing browser updates [2]. They don’t need to ask users for new permissions or submit updated packages to Google for review [1]. If a referral partner shuts down an affiliate account, the proxy operator simply swaps in a fresh partner ID within seconds [2]. Users rarely notice these background shifts because their search queries still land on real search engines [1].
Risks Beyond Chrome Search Hijacking
Socket grouped the offending extensions into distinct waves based on code signatures, promotional themes, and the specific search engines targeted by the syndicates behind the campaign. The largest wave was SecuryBrowse, which counted 58 separate add-ons and 4.9 million users. It used security-themed names like Fire Shield, Securify, and WatchTower to build false trust. A second cluster, labeled Bing-Search, included 37 extensions and 2.2 million users. Bidbrain advertisements promoted many of those add-ons [2].
While the extensions currently aim at referral payouts, Tuckner warned that the underlying threat could worsen rapidly [2]. Because the proxy controls the final destination of every search, operators can shift from ad fraud to hostile attacks without altering the client extension installed on user machines [1]. Tuckner pointed out that referral revenue serves as a “profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads” [2].
Rerouting searches also creates serious privacy problems for regular households and business users alike. Search queries often reveal medical conditions, banking concerns, travel plans, and work research. When proxy servers log these queries, operators compile detailed records of what people search for online [1]. If operators sell that collected data or weaponize it for phishing, victims face substantial security fallout [2].
Steps to Remove Malicious Add-Ons
Google removed most of the 319 offending extensions from the Chrome Web Store after Socket published its report [1]. But taking add-ons off the store doesn’t delete them from computers where people already installed them [2]. Operators also upload fresh copies under different names to keep the traffic flowing [1]. Bill Toulas reported for BleepingComputer that the publication contacted Google for comment regarding Socket’s findings, but the search giant didn’t reply before publication of the investigation [2]. Tuckner suggested that because Google benefits from advertisements and marketplace activity, there may not be an urgent commercial push to police these add-ons aggressively across the ecosystem [1].
Users who experience unexpected browser redirects should check their installed extensions right away [1]. People can open the extensions page in Chrome, review the list of installed add-ons, and remove any tools they don’t recognize or no longer need for daily browsing [2]. Security researchers advise running a full antivirus scan on Windows PC and Mac computers after cleaning out suspicious add-ons. A full scan helps detect whether secondary malicious software slipped onto the machine during unauthorized redirects [1].
Sticking to well-known add-ons from verified developers remains the best way to prevent future browser hijackings. Before installing any tool, users should read recent reviews, check the developer’s credentials, and steer clear of software promoted through aggressive pop-ups on third-party download portals. For users concerned about stolen login details or fraud, identity theft protection services can help monitor credit reports and recover compromised personal information after a cyberattack [1]. Staying alert when adding browser extensions keeps personal data safe from predatory redirect syndicates [2].
- ONLINE NEWS Younker, S. (2026, October 30). Over 300 Chrome extensions found hijacking searches of 13.4 million users — how to stay safe. Tom’s Guide. [Article Link]
- ONLINE NEWS Toulas, B. (2026, October 29). Chrome extensions with 13.4 million installs caught hijacking searches. BleepingComputer. [Article Link]
