319 Chrome Extensions Hijack Searches, Impacting 13.4 Million Users
A vast network of 319 Chrome extensions, disguised as utility tools, has been discovered hijacking user searches and redirecting them through operator-controlled servers, affecting an estimated 13.4 million users over the past decade.
A sprawling network of 319 Chrome extensions, masquerading as helpful tools like PDF converters and AI search assistants, has been found to systematically hijack user searches. These malicious extensions redirect search queries through operator-controlled servers before they reach legitimate search engines such as Yahoo or Bing. This elaborate scheme generates referral income for the operators by injecting advertising and tracking parameters into user searches, effectively turning everyday queries into a revenue stream.
Researchers from Socket.dev identified this extensive operation, noting that the technique exploits a fundamental Chrome setting: chrome_settings_overrides.search_provider. This allows an extension to replace the user's default search engine. Alarmingly, the extensions often require minimal permissions and may not even employ visible scripts or interfaces, making them difficult to detect during routine security reviews. While Chrome displays a prompt about changing search settings, Socket points out that it doesn't adequately inform users about the ultimate destination of their search queries, creating a significant detection gap.
The impact of this search hijacking is substantial, with an estimated 13.4 million users affected over a ten-year period. While this figure represents the cumulative reach, it's important to note that not all users may be actively impacted simultaneously. The investigation revealed that one researcher, John Tuckner, identified an additional 264 extensions affecting approximately 8.7 million users, highlighting the persistent nature of this threat. The primary mechanism involves an intermediary server that intercepts searches, allowing operators to control the destination and potentially log sensitive query data.
Unlike more invasive malware, this search hijacking operation can occur without requiring elevated privileges or deploying complex malicious scripts. The extension "Predator Search" served as a prime example, demonstrating how identical queries could yield varied results, including legitimate search engine pages, additional redirect chains, or error pages, all controlled by the extension's server-side logic. While the observed traffic was primarily referral-tagged and not directly linked to phishing delivery, the potential for escalation to more malicious activities remains a concern.
The privacy implications extend beyond a simple change in search results. User search queries can inadvertently reveal highly personal information, including health concerns, financial difficulties, or sensitive work-related projects. The intermediary server's visibility into these queries poses a significant privacy risk, as the data is processed before reaching the intended search engine, even if the final results page appears normal.
Many of these malicious extensions were not readily discoverable in the Chrome Web Store, often being "unlisted" and accessible only through direct links. Their distribution relied heavily on paid advertisements, including popovers and popunders, which directed users to landing pages promoting the seemingly useful tools. This hidden distribution method further complicates detection and user awareness.
Socket.dev was able to link significant clusters of these extensions to specific entities. Approximately 111 extensions, affecting around 2.2 million users, were tied to Intango LTD. Another group, "SecuryBrowse," comprised 58 extensions impacting roughly 4.9 million users. Evidence of coordinated operations, such as synchronized updates across different publisher accounts, suggests a high degree of organization among the threat actors.
For defenders, the findings underscore the importance of monitoring not just extension permissions but also search configurations. Organizations are advised to investigate unexplained search redirects and enforce policies restricting unapproved extensions. Users should proactively remove unfamiliar add-ons and regularly verify their default search engine settings to mitigate the risks associated with these pervasive search-hijacking campaigns.