Chrome Extensions with 13.4 Million Installs Caught Hijacking Searches
Socket says the extensions have 13.4 million combined installs and can later redirect users to phishing or malicious download pages.
- Researchers identified a search-hijacking campaign involving 319 Chrome extensions affecting 13.4 million users by redirecting web searches through tracking servers to generate advertising revenue from Bing and Yahoo.
- Socket researcher John Tuckner explained that operators use Chrome's 'chrome_settings_overrides' setting to replace default search providers, routing queries through suspicious proxy servers to collect partner referral payments.
- The largest cluster, "Bing-Search," includes 37 extensions and 2.2 million users, while the "SecuryBrowse" wave features 58 extensions and 4.9 million users, often masquerading as PDF converters or safety tools.
- Tuckner warned that proxy operators can redirect traffic to malicious phishing pages at any time; "The extension never changed; the proxy chose each destination as the search came in," he reported.
- Google removed most extensions from the Chrome Web Store, though new ones appear constantly; users should uninstall suspicious tools and run a full antivirus scan to secure systems.
20 Articles
20 Articles
BleepingComputer
cybernoz.comChrome extensions with 13.4 million installs caught hijacking searches
A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo.
319 Chrome extensions with 13 million installations stole searches and earned advertisements. Here's how to check if you're at risk. Article 319 Chrome extensions with 13.4 million installations hijacked your searches on Bing and Yahoo seems to be the first on Smartworld.
More than 300 Google Chrome extensions intercept user searches before they reach the searcher. Identifyed by the cybersecurity company Socket, the tools make queries go first through servers controlled by the plugins. Then, they are forwarded to Bing or Yahoo, without the user noticing the change. Over ten years, these extensions have accumulated about 13.4 million installations. The technique explores a native Chrome resource that allows extens…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
