A search-hijacking campaign built from 319 Chrome extensions reached an estimated 13.4 million installs over roughly a decade, according to research Socket published on October 29. The extensions posed as PDF converters, manual finders, safe search tools and AI search helpers, and each one changed Chrome’s default search provider so that queries passed through servers run by the people behind them. Malwarebytes summarized the findings the next day.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Nothing about the mechanism is exotic. Each extension leans on a manifest setting that swaps the default search provider, and the sample Socket examined asked for no permissions, ran no background worker and drew no interface. The money comes from partner identifiers attached to Yahoo and Bing results, so operators earn referral payments whenever a hijacked search ends on one of those engines.
A manifest setting that is not even code
John Tuckner of Socket, who wrote the investigation, stresses that the technique is a declaration in the extension’s manifest file under the chrome_settings_overrides key, not code that executes. Searches then route through the operator’s proxy, which logs every query and decides per request where the user lands. Yahoo traffic carries hspart and hsimp parameters, while Bing traffic carries PC and PTAG. In one case, an extension called Predator Search, with about 50,000 users, sent six identical searches to four different destinations.
Pieter Arntz of Malwarebytes, in the company’s write-up, adds that queries were often tied to a unique identifier that could link one person’s searches over time. The operators could also choose where each search went, which could in principle lead to phishing or malware pages, though Socket found no evidence that happened. Tuckner’s verdict is blunt: an extension whose only function is to intercept searches “should be considered malicious by definition.”
Unlisted pages and ad-driven installs
Distribution leaned on advertising. Ads on networks including Google Ads promoted the tools as manual finders, PDF converters, safe search and AI search, and Socket describes pop-over ads, often on low-quality sites, steering people to install. The extensions sat in Google’s official Chrome Web Store, but most were unlisted: anyone with a direct link could install them, while ordinary store searches would not surface them.
Google’s published rules cut against the business model. Under the Chrome Web Store user data policy, web browsing activity may be collected only for a user-facing feature that is prominently described, monetizing that data for ad targeting is not permitted, and the disclosure must appear in the extension’s own interface rather than only in a privacy policy or store listing. Socket’s post carries no response from Google, and the Malwarebytes article does not say whether the 319 extensions have been removed.
Intango, SecuryBrowse and 119 unidentified operators
Socket splits the 319 by who stands behind them. Some 200 extensions, with about 5.68 million users, trace to identified operators, while 119, with about 7.76 million users, trace to operators it could not name. Intango LTD accounts for 111 extensions and roughly 2.19 million users across about 279 domains since 2018. Free Planet VPN S.R.L. has one extension with about 2 million users. Smaller publishers include Tightrope Interactive with 18 extensions, Vimaok Limited with 12 and Mutual Media with 9.
Among the unattributed clusters, the SecuryBrowse wave of 2024 covered 58 extensions and about 4.9 million users, and 37 “Bing-Search” extensions pushed through Bidbrain ads since April 2025 reached about 2.2 million. In June 2026, fifteen publishers pushed updates within four days, a pattern Socket links to one actor.
The history stretches back further. A Russian-language “Yandex search” extension with about 200,000 users appeared in 2016 and was later taken down, and two Yahoo new-tab hijackers under the HermesTab name reached about 400,000 users in 2017. Socket counts 264 extensions as newly identified in this round, adding about 8.7 million users, and credits earlier work by SecureAnnex plus help from researchers at Censys, urlscan and DecryptAds.
Checking Chrome for a hijacked search setting
Malwarebytes advises opening chrome://extensions and removing anything unrecognized, unused or untrusted, then checking the search engine under Settings. If Chrome reports that an extension controls the setting, that extension should be reviewed or removed, and the absence of such a notice does not prove an extension is safe. It also suggests comparing installed extensions with the list at the end of Socket’s post.
Google’s own help pages describe the same checkpoints. The search engine page walks through Settings, Search engine and Change, and says an unexpectedly altered default might signal malware. The extension management page places the controls under More, Extensions and Manage extensions, with the advice to turn on only extensions that are trusted. Resetting Chrome’s settings can switch extensions off, so some may need to be re-enabled there afterward. One number deserves care. The 13.4 million figure counts estimated installs across a decade, not people running the extensions today, and Socket’s post does not say how many remain active, so the count of people still exposed today is unknown.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
