A sweeping Chrome extension campaign discovered a decade-long search hijacking scheme affecting an estimated 13.4 million users. The culprit: 319 browser add-ons marketed as utility tools—PDF converters, “safe search” assistants, AI helpers, and more—that secretly redirect user search queries through third-party servers before pointing them to Yahoo, Bing or similar providers.
What’s lurking beneath the surface
These extensions exploit Chrome’s chrome_settings_overrides.search_provider feature to replace a user’s default search engine, rerouting queries through operator-controlled proxies that capture search data and insert referral codes. Installation prompts alert users to search engine changes, but they offer little clarity about where searches are truly headed.
In many cases, the extensions seem benign—one example named Safe Game Search included nothing but a manifest and icons. It requested no extra permissions, had no visible scripts, background workers, or toolbars—yet still inserted a search redirect. Just by configuring search settings, an extension can intercept user traffic without triggering the usual alarms raised by malware or invasive permissions.
Scale, operators & hiding in plain sight
Researchers identified hundreds of extensions (most unlisted in the Chrome Web Store, but still reachable via direct links) that rolled out via ads—popups, landing pages—which promised helpful tools in exchange for install. Over time, multiple clusters of these extensions were tied to a handful of operators.
One cluster tied ~111 extensions and ~2.2 million installs to Intango LTD; another—SecuryBrowse—was linked to 58 extensions and ~4.9 million users. A separate group focused on Bing redirects included 37 extensions, likely maintained under different publisher names but showing signs of shared infrastructure and coordinated updates.
The research dug into privacy policies, ad transparency records, URL scans, and shared domains to map relationships. Even long‐hidden domains, inactive listings, or unregistered store pages showed footprints of this search hijacking ecosystem.
Risk, detection & prevention
Though there’s no widespread evidence of phishing payloads being delivered through this vector, the exposure risk is clear. Intermediary redirect servers can observe search terms—potentially revealing personal interests, workplace details, financial or health concerns.
Key indicators of compromise include unusual extension IDs (like the one tied to a tool called Predator Search), domains formerly serving as proxies or redirect tools, and referral/tracking parameters embedded in redirected search URLs. These signals can help users or security operations teams trace when their search traffic is being manipulated.
Defensive measures include removing unfamiliar or untrusted extensions, reviewing your browser’s default search engine settings regularly, and deploying extension audits in managed or enterprise environments. Organizations especially should take note of unexplained search redirects and consider restricting installation of unvetted browser add-ons.
What this means: This discovery highlights how extensions that appear harmless—little more than icons or simple converters—can be central to large‐scale search hijacking schemes. The fact that this activity has persisted for years, using unearthed listings and shared infrastructure, underscores a broader threat: browsers’ extension models may be wide open to misuse if default feature settings are exploited. Going forward, browser vendors, ad platforms, and security teams must strengthen transparency around search overrides and tighten enforcement around extension listing and permission reviews—and users should treat any extension that changes their search provider with healthy skepticism.
