Chrome extensions with 13.4 million installs caught hijacking searches

Massive Search-Hijacking Campaign Uncovered

A new report details a large-scale search-hijacking operation involving 319 Chrome extensions. These extensions have accumulated 13.4 million installations and are designed to redirect user searches through intermediary tracking servers. The primary goal of this redirection is to generate advertising revenue from search engines like Bing and Yahoo.

Expansion of Previous Discovery

This report expands on an earlier discovery of 57 such extensions with 6 million users. The updated findings add 264 newly identified add-ons, accounting for an additional 8.7 million users. The extensions are created by organized operators who quietly take over the browser's default search engine and route queries through suspicious proxy servers to collect referral payments.

Deceptive Functionality and Distribution

The identified extensions often masquerade as utility tools such as PDF converters, manual finders, safe search, or AI search tools. However, their core function is to redirect searches. Although hosted on the Chrome Web Store, these extensions are unlisted and are promoted through advertisements on various websites rather than appearing in store searches.

Technical Mechanism and Risks

Many of these extensions require minimal code, utilizing Chrome's built-in 'chrome_settings_overrides' setting to replace the default search provider. While currently focused on ad revenue, the report warns that the final destination of redirected searches could change without updating the extension. This poses a risk of users being redirected to phishing sites or malicious downloads in the future.