Researchers at Socket have identified a search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installs. According to BleepingComputer’s summary of the report, the extensions replace the browser’s default search provider and send every query through an operator-controlled proxy before it reaches Bing or Yahoo, so the operators collect partner referral payments. The report builds on Socket’s April 2025 finding of 57 such extensions with 6 million users, adding 264 newly identified ones with another 8.7 million users.
The add-ons pose as PDF converters, manual finders, “safe search” and AI search tools. Socket says they are hosted on the Chrome Web Store but unlisted, so they do not show up in store searches and are instead promoted through ads on other websites. Many need almost no code: one example contains only a manifest and icons, using Chrome’s built-in search-provider override. The main risk today is ad-fraud revenue, but Socket’s researcher warns the proxy can change where searches end up at any time without updating the extension, for example to phishing pages or malicious downloads. In one test, six identical searches through a single extension ended up in four different places.
How to check if you’re affected
Affected products are any of the 319 Chrome extensions named in the list at the bottom of Socket’s report; the largest recently active clusters are “Bing-Search” (37 extensions, 2.2 million users) and “SecuryBrowse” (58 extensions, 4.9 million users, with security-themed names such as Fire Shield, Securify and WatchTower).
- Open
chrome://extensionsand compare each installed extension’s name against Socket’s list. Socket says most of these had been removed from the Chrome Web Store when the report was published, but new ones keep appearing. - Uninstall any that match, and avoid installing add-ons you do not need or that come from unknown publishers. BleepingComputer also recommends running a full antivirus scan.
- Because these extensions work by changing the default search provider, it is also worth checking which search engine your browser is currently set to use.
Sources
- Socket: “Searchjacked” report (link taken from BleepingComputer’s article; the page returned a bot challenge, so its contents were not read directly and the details above are as reported by BleepingComputer)
- BleepingComputer: Chrome extensions with 13.4 million installs caught hijacking searches