Unlisted Chrome extensions with 13M+ installs are hijacking search queries
A massive security threat has impacted millions of web users as 319 unlisted Chrome extensions were caught quietly hijacking default search settings. Socket discovered the malicious campaign, which reroutes user search queries through hidden proxies and operator servers to generate referral revenue. These suspicious browser add-ons managed to accumulate 13.4 million installations while performing basic or minimal utility tasks, often operating without requiring any sensitive permissions from the user. Security researchers warn that this campaign escalates from simple adware into a legitimate phishing risk.
Listen to Live Briefing
Real-time synthesized voice briefing · Live Feeds Desk
- ✓ A campaign involving 319 Chrome extensions hijacked default search settings for 13.4 million users.
- ✓ The malicious extensions rerouted user search queries through operator servers and hidden proxies to generate referral revenue.
- ✓ Many of the suspicious browser add-ons required zero sensitive permissions to operate.
What changed
Security researchers uncovered a large-scale campaign involving 319 unlisted Chrome extensions that redirected search queries for 13.4 million users.
Live updates
-
Chrome Extensions Hijack Searches for 13M Users
A massive security threat has impacted millions of web users as 319 unlisted Chrome extensions were caught quietly hijacking default search settings. Socket discovered the malicious campaign, which reroutes user search queries through hidden proxies and operator servers to generate referral revenue. These suspicious browser add-ons managed to accumulate 13.4 million installations while performing basic or minimal utility tasks, often operating without requiring any sensitive permissions from the user. Security researchers warn that this campaign escalates from simple adware into a legitimate phishing risk.
Why it matters
Browser extensions represent a common vector for monetization schemes due to the deep integration they maintain with web traffic and user browsing habits. Attackers frequently deploy add-ons that appear harmless on the surface to bypass initial store vetting before activating malicious search redirection. This campaign highlights ongoing challenges in automated platform moderation regarding unlisted tools.
What is confirmed
- A campaign involving 319 Chrome extensions hijacked default search settings for 13.4 million users.
- The malicious extensions rerouted user search queries through operator servers and hidden proxies to generate referral revenue.
- Many of the suspicious browser add-ons required zero sensitive permissions to operate.
Still unconfirmed
- The campaign creates an escalation path from adware into direct phishing risks for affected users.
What to watch next
- Official response and removal actions from Google regarding the unlisted extensions
- Further technical analysis detailing the infrastructure of the proxy servers used in the redirection
confidence 100%Sources used for this update (10)
- Cybernews — Unlisted Chrome extensions with 13M+ installs are hijacking search queries
- BleepingComputer — Chrome extensions with 13.4 million installs caught hijacking searches
- Digital Trends — Your search engine could be hijacked by a Chrome extension that barely does anything
- GBHackers News — 319 Suspicious Chrome Extensions Hijack Default Search Settings Without Sensitive Permissions
- CyberInsider — Microsoft finds 250 browser extensions linked to tracking campaign
- cybersecuritynews.com — 319 Chrome Extensions Found Hijacking Searches, Affecting 13. ...
- www.bleepingcomputer.com — Chrome extensions with 13.4 million installs caught hijacking ...
- www.howtogeek.com — Hundreds of Chrome extensions were caught hijacking searches ...
- www.gblock.app — 319 Chrome Extensions Hijacked Searches for 13.4M Users
- aviatrix.ai — 319 Chrome Extensions Hijack 13.4M Users' Searches | Aviatrix ...
Community Sentiment: How do you assess this situation?
Voice your perspective · Real-time aggregated sentiment from the Live Feeds community