conv.

All stories
SecurityQuiet 11d · day 13

13.4M Chrome extension users hit by search hijacking campaign

Researchers uncover 319 browser extensions that silently redirect searches to Yahoo and Bing for referral revenue.

newest coverage 10d agosummary written 12d ago10 pieces13 likes & upvotes2 comments Hacker NewsGoogle NewsNewswiresMastodonReddit

What to know

  • 319 Chrome extensions with 13.4 million total installs redirect user searches to Yahoo and Bing proxies to earn referral commissions, despite providing no utility.
  • Operators hide extensions from Web Store indexing while promoting them through cheap ads, relying on minimal permissions and opaque branding to evade detection.
  • The scheme exploits both Yahoo and Microsoft's search syndication programs and may persist partly because Google benefits from advertising spend by hijackers.

Socket Security researcherYahoo Search partnerMicrosoft (Bing) Search partnerGoogle Platform operator

13.4M Chrome extension users hit by search hijacking campaign
socket.dev

How it unfolded 3 developments, newest first · click a bar or a number to jump articlesposts

Peak 4 pieces in 3h at Oct 29, 10 AM; 10 pieces over 14 days (5 articles · 5 posts) Oct 29, 10 AM — 4 pieces · 4 articles — Google News 4Oct 29, 1 PM — 1 piece · 1 post — Hacker News 1Oct 29, 4 PM — quietOct 29, 7 PM — quietOct 29, 10 PM — quietOct 30, 1 AM — 1 piece · 1 post — Hacker News 1Oct 30, 4 AM — quietOct 30, 7 AM — quietOct 30, 10 AM — quietOct 30, 1 PM — 1 piece · 1 article — Newswires 1Oct 30, 4 PM — quietOct 30, 7 PM — quietOct 30, 10 PM — quietOct 31, 1 AM — quietOct 31, 4 AM — quietOct 31, 7 AM — quietOct 31, 10 AM — quietOct 31, 1 PM — quietOct 31, 4 PM — quietOct 31, 7 PM — quietOct 31, 10 PM — quietNov 1, 1 AM — quietNov 1, 3 AM — 3 pieces · 3 posts — Mastodon 2, Reddit 1Nov 1, 6 AM — quietNov 1, 9 AM — quietNov 1, 12 PM — quietNov 1, 3 PM — quietNov 1, 6 PM — quietNov 1, 9 PM — quietNov 2, 12 AM — quietNov 2, 3 AM — quietNov 2, 6 AM — quietNov 2, 9 AM — quietNov 2, 12 PM — quietNov 2, 3 PM — quietNov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — quietNov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quietToday, 6 AM — quietToday, 9 AM — quietToday, 12 PM — quietToday, 3 PM — quietToday, 6 PM — quiet 1–23
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9now · 9:14 PM ET
  1. 3

    BleepingComputer amplifies findings of search hijacking campaign

    BleepingComputer reports on the Chrome extension hijacking findings, bringing wider security community attention to the 13.4 million affected users and the organized operators behind the scheme.

  2. 2

    Socket investigation details mechanics of search hijacking scheme

    Socket's detailed analysis reveals the extensions use manifest files to change default search providers without clear user disclosure, route searches through suspicious proxies, and operate under shallow branding like 'Safe Web Search' or 'PDF Manual Finder.' The investigation identified 264 newly discovered extensions adding to 8.7 million additional affected users.

    “An extension whose only function is to intercept searches users could have made anyway, that is purposefully hidden from indexing, promoted through low-value advertising listings, and provides no additional value should be considered malicious by definition.”
    — Socket researchers
    1. 1 outlet Over 300 Chrome extensions found hijacking searches of 13.4 million users — how to stay safe

      first by Tom's Guide, 12d ago

  3. 1

    Socket and security outlets report 319 search-hijacking extensions affecting 13.4M users

    Security researchers published findings that 319 Chrome extensions installed across 13.4 million users are hijacking search queries and routing them through proxy servers to collect referral payments from Yahoo and Bing. The extensions are promoted through paid advertising and hidden from indexing, with no utility beyond changing default search providers.

    1. 2 outlets Chrome extensions with 13.4 million installs caught hijacking searches

      first by BleepingComputer, 13d ago · also Cybernews

      1 more headline