319 Chrome Extensions Reportedly Hijacked Searches for Ad Revenue
Summary
Socket reported 319 Chrome extensions with 13.4 million combined reported installs that routed searches through operator-controlled proxies for referral revenue. Researchers warn the destinations could change to phishing sites or malicious downloads.
Key points
- Socket researcher John Tuckner identified 264 additional extensions, expanding on a 2025 discovery of 57 extensions.
- The extensions pose as tools such as PDF converters and AI search add-ons, and redirect searches through proxy servers to Bing or Yahoo for referral revenue.
- Many reportedly use Chrome's chrome_settings_overrides setting to replace the default search provider and require little code.
- In tests of the Predator Search extension, six identical searches reached four different destinations, including searchlio[.]net and mcftink[.]com.
- The researcher warned that proxy operators could change destinations to phishing pages or malicious downloads without updating the extensions.
- The report said most identified extensions had been removed from the Chrome Web Store, but new ones continue to appear; users were advised to uninstall listed extensions and run a full antivirus scan.
Article Details
- Event Type
- Search-hijacking campaign involving 319 Chrome extensions.
- Impact
- The extensions had a combined 13.4 million reported installations and redirected searches through proxy servers to generate referral revenue from Bing and Yahoo. The researcher warned that destinations could change to phishing sites or malicious downloads. Most extensions had been removed from the Chrome Web Store when the report was published, but new ones were still being added.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mcftink[.]com | Reported second results domain reached through the Predator Search extension's search-redirection chain. |
| DOMAIN | searchlio[.]net | Reported landing-page destination in the Predator Search extension's search-redirection chain. |
| DOMAIN | searchtosearch[.]com | Reported intermediary in the Predator Search extension's search-redirection chain. |
People
Vendors
Products
Binginstallations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo.Google ChromeChrome extensions with 13.4 million installs caught hijacking searchesYahooredirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo.