conv.

← The whole story
Security
13.4M Chrome extension users hit by search hijacking campaign

Socket investigation details mechanics of search hijacking scheme

2 Oct 29 2:15 PM · 13d ago · 1 post · 1 source · development 2 of 3

Socket's detailed analysis reveals the extensions use manifest files to change default search providers without clear user disclosure, route searches through suspicious proxies, and operate under shallow branding like 'Safe Web Search' or 'PDF Manual Finder.' The investigation identified 264 newly discovered extensions adding to 8.7 million additional affected users.

Socket investigation details mechanics of search hijacking scheme
socket.dev

“An extension whose only function is to intercept searches users could have made anyway, that is purposefully hidden from indexing, promoted through low-value advertising listings, and provides no additional value should be considered malicious by definition.”

Socket researchers

Socket Security researcherYahoo Search partnerMicrosoft (Bing) Search partnerGoogle Platform operator

The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump

Peak 4 pieces in 3h at Oct 29, 10 AM; 10 pieces over 14 days (5 articles · 5 posts) Oct 29, 10 AM — 4 pieces · 4 articles — Google News 4Oct 29, 1 PM — 1 piece · 1 post — Hacker News 1Oct 29, 4 PM — quietOct 29, 7 PM — quietOct 29, 10 PM — quietOct 30, 1 AM — 1 piece · 1 post — Hacker News 1Oct 30, 4 AM — quietOct 30, 7 AM — quietOct 30, 10 AM — quietOct 30, 1 PM — 1 piece · 1 article — Newswires 1Oct 30, 4 PM — quietOct 30, 7 PM — quietOct 30, 10 PM — quietOct 31, 1 AM — quietOct 31, 4 AM — quietOct 31, 7 AM — quietOct 31, 10 AM — quietOct 31, 1 PM — quietOct 31, 4 PM — quietOct 31, 7 PM — quietOct 31, 10 PM — quietNov 1, 1 AM — quietNov 1, 3 AM — 3 pieces · 3 posts — Mastodon 2, Reddit 1Nov 1, 6 AM — quietNov 1, 9 AM — quietNov 1, 12 PM — quietNov 1, 3 PM — quietNov 1, 6 PM — quietNov 1, 9 PM — quietNov 2, 12 AM — quietNov 2, 3 AM — quietNov 2, 6 AM — quietNov 2, 9 AM — quietNov 2, 12 PM — quietNov 2, 3 PM — quietNov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — quietNov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quietToday, 6 AM — quietToday, 9 AM — quietToday, 12 PM — quietToday, 3 PM — quietToday, 6 PM — quiet 1–23
1–2Socket investigation details mechanics of…3BleepingComputer amplifies findings of…
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9now · 9:15 PM ET

What was reported 1 claim about this development

  1. 1 outlet Over 300 Chrome extensions found hijacking searches of 13.4 million users — how to stay safe

    first by Tom's Guide, 12d ago

All 3 developments of 13.4M Chrome extension users hit by search hijacking… →

Hacker NewsGoogle NewsNewswiresMastodonReddit