Investigation Links 319 Search-Hijacking Extensions to About 13.4 Million Installs

Oct 29, 2026 · Original article ↗

Summary

Socket’s investigation identified 319 search-hijacking Chrome extensions with about 13.4 million installs over a decade. They route queries through operator-controlled proxies for referral revenue; researchers warn this could enable selective malicious redirects, but do

Key points

Researchers identified 264 additional extensions, bringing the total to 319 and about 13.4 million installs over roughly a decade.
The extensions change the browser’s default search provider and route queries through operator-controlled proxy servers, often without requesting permissions or using background scripts.
The proxy gives operators a point to capture search queries and choose destinations per request; queries may be tied to a unique identifier.
In tests with the Predator Search extension, six identical searches reached four destinations, including Yahoo results, searchlio[.]net, a route through searchtosearch[.]com to mcftink[.]com, and a Cloudflare error page.
The report describes phishing pages and malware lures as possible risks of selective redirection; it does not establish that the observed redirects served malicious content.
Researchers mapped operators and distribution using Chrome Web Store listings, advertising transparency data, Censys, Urlscan, and DecryptAds; many extensions were unlisted and promoted through ads.

Article Details

Attack Vectors: Search-hijacking extensions were promoted through paid advertisements and popovers, often under utility-themed branding such as PDF converters or manual finders, and were frequently unlisted from Chrome Web Store search.
The extensions changed the browser's default search provider so queries passed through an operator's proxy before reaching Yahoo or Bing.
The proxy captured search queries and selected redirects per request. The article reports observed redirects through intermediary domains and says selective phishing or malware-lure redirects are a potential risk, not a confirmed behavior.
Operators monetized redirected searches through Yahoo or Bing syndication partner identifiers.
Defensive Notes: Do not treat an extension's lack of requested permissions as proof that it is safe; changing the default search provider through the manifest can still route searches through an operator's server.
Scrutinize extensions whose only function is changing the default search provider, especially when promoted by low-value advertisements or hidden from store search.
The article says extension removals may not stop the activity because new domains and lures can appear quickly.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`extension-search[.]online`	Domain through which the article says a search-hijacking extension forced Yandex as the default search provider.
DOMAIN	`mcftink[.]com`	Second results domain observed in a Predator Search redirect chain before the query reached Yahoo.
DOMAIN	`searchlio[.]net`	Redirect destination observed when Predator Search routed a search through its proxy.
DOMAIN	`searchtosearch[.]com`	Intermediate redirect domain observed in a Predator Search query-routing chain.
URL	`hxxps[:]//search[.]safesearchgame[.]com/query?q={searchTerms}`	Search endpoint configured in the manifest of an analyzed search-hijacking extension; queries are routed through this operator endpoint.
URL	`hxxps[:]//suggest[.]safesearchgame[.]com/querying/autocomplete?query={searchTerms}`	Autocomplete endpoint configured in the manifest of an analyzed search-hijacking extension.