Over 300 Chrome extensions found hijacking searches of 13.4 million users — how to stay safe
Latest from Tom's Guide ·
Scott Younker is the West Coast Reporter at Tom’s Guide. He covers all the latest tech news, including phones, computing and more. He’s been involved in tech since 2011 covering everything from cameras and swimming pool equipment to the latest gaming consoles and smart TVs. He is on a seemingly never ending hunt to build the easiest to use home media system. Before Tom’s Guide, Scott worked for publications like Digital Trends, Outdoor Photographer, Dead Beats Panel , and in a brief detour, America’s Funniest Home Videos . Yes, he has seen more pratfalls, silly pets and ridiculous home movie fails than is reasonably healthy. When not writing about the latest devices or advances in chipsets, be sure to ask about Scott about disc golf and sustainability, or just if you’re being cheeky, ask about his noodle arm. If you truly want to get nerdy, bring up board games and his ongoing losing streak. Scott joined Tom's Guide in 2024 as the West Coast Reporter. He graduated from the School of Journalism at the University of Oregon with a degree in magazine journalism and a minor in communications. While there he blogged or wrote for several magazines including the Fluxx, Ethos and the Oregon Commentator. He briefly wrote and managed a moderately successful blog focused on web comics. Send secure tips on Signal: scyo1.55.
An ongoing security investigation by Socket's John Tuckner (via Bleeping Computer ) has discovered a search-hijacking campaign that involves 319 Chrome extensions with a combined 13.4 million downloads. The malicious extensions redirect search queries through tracking servers to generate advertising revenue from Bing and Yahoo.
It's more than double from Tuckner's April report that found "only" 57 Chrome extensions and 6 million downloads.
According to Tuckner, the malicious extensions are usually found on websites advertising tools that are labeled as "PDF converter", "AI search", or "safe search".
"These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID," Tuckner wrote.
The extensions apparently aren't found on the official Chrome Web Store either. Rather, they're unlisted and are only really found through the shady advertising.
Apparently, the extensions use Chrome's built-in 'chrome_settings_override' setting that lets them replace your default search provider.
What this means is that your searches are captured as they pass through the operator's server. After that the redirect could be sent through a site with malware attached, though currently, per Tuckner they're mostly routing to Yahoo and Bing and to falsely claim advertising revenue.
"The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads," Tuckner said.
As of this writing, the report says that most of the extensions have been removed the Chrome Web Store when the report was published, however, new ones are constantly being added.
"Ultimately, Google can benefit from more advertisements being run and more extensions being listed in the marketplace so there may not be an urgent reason to police this activity too broadly."
Even if Google isn't policing this specific type of extension, malicious add-ons do slip through to the Chrome Web Store from time to time. When it comes to extensions, you need to be extra careful when downloading and adding them to your browser.
Normally, we would recommend you stick to well-known extensions from trusted brands. However, sometimes a lone developer creates one that does exactly what you need.
There are several recommendations we have to help you be a bit safer. Check the ratings and reviews of the extensions but also dig into the developer to see if they're legit.
Look, even good extensions can go bad , so you want to make sure that your Windows PC is protected with the best antivirus software and that you’re using the best Mac antivirus software on your Apple computer. That way, if an extension is spreading malware or other viruses, they’ll be detected and stopped before they can do any damage.
If you're constantly trying different extensions, you should consider one of the best identity theft protection services . They can help get your identity back if it's stolen or recover lost funds due to scams and cyberattacks.