A large search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million (1.34 crore) reported installations redirected users’ search queries through operator-controlled servers before sending them to Bing or Yahoo, according to security research by Socket.
The campaign expanded significantly from an earlier investigation in April 2025, when 57 Chrome extensions with about six million users were identified. Researcher John Tuckner has now linked another 264 extensions, adding about 8.7 million (87 lakh) reported users to the broader operation.
The extensions were presented as tools such as PDF converters, manual finders, safe-search utilities and AI search applications. In many cases, however, their primary function was to alter the browser’s default search engine and route queries through intermediary servers.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
Search Queries Routed Through Tracking Infrastructure
According to Socket, the operators used Chrome’s built-in chrome_settings_overrides setting to replace users’ default search providers.
Some extensions required almost no additional code to perform the redirection. One example examined by researchers contained only a manifest file and icons, without background scripts, content scripts or special permissions.
Once installed, searches could be passed through proxy infrastructure controlled by the extension operators before eventually reaching Yahoo or Bing.
Socket said the operators could earn referral payments through syndication partner identifiers attached to the redirected traffic.
Although the extensions were hosted on the Chrome Web Store, many were unlisted and did not appear in normal searches on Google’s official extension marketplace. Instead, users were allegedly directed to the add-ons through advertisements appearing on other websites.
Researchers linked the extensions to a small number of organised operators following similar techniques.
One of the largest recently active groups, labelled “Bing-Search”, consisted of 37 extensions with about 2.2 million users. Another cluster, called “SecuryBrowse”, contained 58 extensions with around 4.9 million users and included security-themed products such as Fire Shield, Securify and WatchTower.
Researchers Warn Redirects Could Become More Dangerous
While the campaign currently appears focused on generating revenue from search referrals, researchers warned that the same infrastructure could potentially be used for more harmful activity.
Because queries pass through servers controlled by the operators, the destination can reportedly be changed without requiring an update to the Chrome extension itself.
Tuckner warned that this could allow operators to redirect users to phishing websites, malicious downloads or other harmful destinations in the future.
The Predator Search extension demonstrated how unpredictable the redirection process could be.
During testing, six identical searches performed through the extension produced four different outcomes. Some searches were sent directly to Yahoo with partner identifiers, while others moved through additional websites before reaching search results.
One route passed through searchlio.net, while another went through searchtosearch.com and mcftink.com before ultimately reaching Yahoo. Another attempt resulted in a Cloudflare error page.
The extension itself had not changed between the searches, indicating that the proxy infrastructure was selecting the destination dynamically.
Most Extensions Removed but New Ones Continue to Appear
Socket said most of the extensions identified in its latest research had been removed from the Chrome Web Store by the time the report was published.
However, the researcher warned that new extensions using similar techniques continue to appear.
The campaign illustrates how browser extensions that may initially resemble potentially unwanted programs can create wider security risks because of their ability to control search behaviour and route traffic through external infrastructure.
Users of the identified extensions have been advised to remove them from their browsers, carry out a full antivirus scan and avoid installing unnecessary browser add-ons from unfamiliar publishers.
The research also highlights the risk of relying solely on an extension’s presence in an official marketplace as evidence that it is safe.
Google had been contacted for comment on Socket’s findings, but no response had been received at the time of publication.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
