319 Chrome extensions with a combined user count of roughly 13.4 million redirect searches through operator-controlled servers to generate revenue from Yahoo and Bing referrals.
Socket traced the operations using extension listings, landing pages, privacy policies, and advertising records, alongside data from Censys, urlscan, and DecryptAds. Many extensions were promoted as PDF tools, manual finders, security utilities, or AI search products.
The schemes exploit search syndication programs operated by Yahoo and Microsoft, which share advertising revenue with partners that supply search traffic. Tracking parameters attached to redirected queries identify the partner entitled to compensation.
Search hijacking without executable code
Some extensions require remarkably little functionality to participate. One example, Safe Game Search, consists of a manifest file and three icons, with no background worker, content scripts, toolbar interface, or requested permissions.
Instead, it uses Chrome’s built-in search-provider override to make an operator-controlled address the default destination for searches. Although installation triggers a prompt about changing the search provider, Socket says this does not clearly explain where queries ultimately travel.
This arrangement sends searches through an intermediary, which then forwards them to Yahoo or Bing with referral identifiers. The intermediary can see the queries passing through it, creating a privacy exposure even when the extension lacks permissions typically associated with data theft.
Socket warns that operators could associate queries with identifiers or IP addresses and potentially monetize the resulting data.
The servers also control where individual searches go, allowing destinations to change without an extension update.
In tests involving Predator Search, an extension with 50,000 reported users, six identical searches produced four different routing outcomes. These included direct Yahoo referrals, an alternative landing page, a longer redirect chain ending at Yahoo, and a Cloudflare error page.
Socket raises phishing pages and malicious downloads as possible future destinations.
Hidden listings, advertising-driven installs
Most of the identified extensions were unlisted in the Chrome Web Store, making them accessible through direct links but absent from store searches and indexing.
Operators drove installations through advertising, including popovers and popunders directing visitors to branded pages with installation buttons. This distribution helps explain how extensions with little visibility in store searches accumulated substantial audiences.
Socket attributed 111 extensions with approximately 2.2 million reported users to Intango LTD. Another cluster of 37 extensions, attributed to an unidentified operator, shared Bing partner tags; 15 ostensibly separate publishers updated extensions within the same four-day period in June 2026.
The findings show why permission requests alone aren’t enough to assess an extension’s privacy impact. Users should review installed extensions, remove unfamiliar or unnecessary search utilities, and check their browser’s default search provider after removal. Installation prompts announcing a search-provider change deserve particular scrutiny, especially when the advertised tool serves an unrelated purpose.
Check Socket’s report for the complete list of the malicious extensions.
Leave a Reply