EN PT-BR
← Voltar ao feed
medium

Searchjacked: 319 Chrome extensions with 13.4M reported installs hijack default search through proxy servers for syndication revenue

2 fonte(s) · 2 atualização(ões) · publicado 29/10/2026 08:53 · coletado há 3 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 30/10/2026 00:03; os links antigos trazem para cá.

Fontes: bleepingcomputer.com ↗ gbhackers.com ↗

Researchers at Socket (reporting by John Tuckner) identified 319 Chrome extensions with about 13.4 million cumulative reported installs in a search-hijacking ecosystem active since 2016, dubbed Searchjacked (gbhackers.com, bleepingcomputer.com). They pose as PDF converters, manual finders, safe-search and AI search tools. They replace the browser's default search engine and send every query through operator-controlled proxy infrastructure before showing Yahoo or Bing results, earning syndication partner referral payments (bleepingcomputer.com). The latest work adds 264 new extensions (about 8.7 million users) to Socket's April 2025 finding of 57 extensions with 6 million users (bleepingcomputer.com). The install counts are cumulative over a decade, not a verified count of currently affected users (gbhackers.com). The proxy destination can be changed server-side at any time, so redirection to phishing pages or malicious downloads is possible. However, no phishing, manipulated results or malware delivery have been demonstrated (gbhackers.com, bleepingcomputer.com). Most of the listed extensions had been removed by 2026-10-29, but new ones keep appearing (bleepingcomputer.com).

Detalhes técnicos

  • The hijack abuses Chrome's chrome_settings_overrides.search_provider manifest setting. It needs no sensitive permissions, background service worker, content scripts or functional UI. One sample, Safe Game Search, contained only a manifest and three icons (gbhackers.com, bleepingcomputer.com). Because the browser configuration does the interception, permission reviews alone cannot detect it (gbhackers.com).
  • The manifest sets an operator-controlled search endpoint as the default and supplies a separate autocomplete endpoint. The intermediary can see queries and tie them to identifiers or network information (gbhackers.com).
  • Monetization works through search syndication, using Yahoo hspart/hsimp parameters or Bing PC/PTAG values (gbhackers.com).
  • The proxy controls each destination. Predator Search (50,000 users) sent six identical searches to four outcomes: Yahoo with partner tags (hspart=sz&hsimp=yhs-026), a landing page on searchlio.net, a hop through searchtosearch.com to mcftink.com before Yahoo, and a Cloudflare error page (bleepingcomputer.com, gbhackers.com).
  • The extensions are on the Chrome Web Store but mostly unlisted. They are promoted through Google Ads and Bidbrain campaigns pointing to branded landing pages, often via popovers or popunders (gbhackers.com, bleepingcomputer.com).
  • Clusters: SecuryBrowse has 58 extensions and about 4.9M users, with security-themed add-ons such as Fire Shield, Securify and WatchTower (bleepingcomputer.com, gbhackers.com). A newer Bing-focused group (Bing-Search) has 37 extensions (both sources). About 111 extensions are linked to Intango LTD (gbhackers.com). Shared partner identifiers and synchronized updates tie apparently separate publishers together (gbhackers.com).
  • Chrome shows a search-change prompt at install, but it does not explain the downstream proxy routing (gbhackers.com).
  • Earlier Secure Annex research documented some extensions with broader permissions, so the set should not all be called permission-free (gbhackers.com).
  • Investigators used store listings, privacy policies, ad transparency records, Censys, urlscan and DecryptAds (gbhackers.com).

Remediação

  • Uninstall any extension listed in Socket's report, run a full AV scan, and avoid add-ons from unknown publishers (bleepingcomputer.com).
  • Inventory installed extensions together with the configured default search provider and redirect chains. Restrict unauthorized extensions by policy and investigate unexplained search changes (gbhackers.com).
  • Have users remove unfamiliar add-ons and verify their search engine setting (gbhackers.com).
  • A minimal manifest does not mean minimal security risk (gbhackers.com).

Relatos divergentes

  • 2.2M users figure: bleepingcomputer.com ties 2.2M users to the 37-extension Bing-Search cluster. gbhackers.com ties 2.2M installs to the roughly 111-extension Intango LTD cluster and gives no user count for the 37-extension Bing group. The sources do not reconcile this, so treat the attribution of the figure as unresolved.
  • Threat framing: bleepingcomputer.com stresses the risk of redirection to phishing or malicious downloads and describes ad referral fraud. gbhackers.com states that only syndication monetization is evidenced and that malicious outcomes are merely possible through server-side routing.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 29/10/2026 13:10 · coletado 29/10 14:00

    319 Chrome extensions with 13.4M installs hijack searches via proxy servers for ad referral fraud

    ler a análise desta fonte

    Socket researcher John Tuckner reported a large-scale search-hijacking campaign involving 319 Chrome extensions totaling 13.4 million installations, expanding on an April 2025 finding of 57 extensions with 6 million users by adding 264 new add-ons with 8.7 million users. The extensions pose as PDF converters, manual finders, safe search and AI search tools, but override the browser's default search engine and route every query through operator-controlled proxy servers before landing on Bing or Yahoo, collecting syndication partner referral payments. Although hosted on the Chrome Web Store, the extensions are unlisted and promoted through shady web advertising rather than store search. Tuckner warns the proxy destination can be changed at any time without updating the extension, enabling redirection to phishing pages or malicious downloads. Most listed extensions had been removed by publication, but new ones keep appearing.

    Technical Details

    • Many extensions require almost no code, abusing Chrome's built-in chrome_settings_overrides manifest key to replace the default search provider; one analyzed sample contained only a manifest and icons, with no background scripts, content scripts, or requested permissions.
    • The Predator Search extension sent six identical searches to four different destinations: Yahoo with partner tags (hspart=sz&hsimp=yhs-026), a landing page on searchlio.net, a hop through searchtosearch.com to mcftink.com before Yahoo, and a Cloudflare error page.
    • Largest recently active clusters: Bing-Search (37 extensions, 2.2M users, promoted via Bidbrain ads) and SecuryBrowse (58 extensions, 4.9M users, security-themed add-ons like Fire Shield, Securify, WatchTower).

    Remediation

    • Uninstall any extension listed in Socket's report, run a full AV scan, and avoid installing browser add-ons from unknown publishers.
  2. gbhackers.com ↗ · pub. 29/10/2026 08:53 · coletado 29/10 09:00 primeiro registro

    319 Chrome extensions hijack default search via manifest-only search_provider override, affecting ~13.4M reported users

    ler a análise desta fonte

    The Searchjacked investigation, reported by Socket researchers, identified 319 suspicious Chrome extensions tied to about 13.4 million cumulative reported users, in a search-hijacking ecosystem active since 2016. Marketed as manual finders, PDF converters, safe search tools and AI search utilities, they route queries through operator-controlled proxy infrastructure before returning Yahoo or Bing results. The latest work adds 264 newly identified extensions (about 8.7 million reported users) to earlier research. The figures are cumulative over a decade and are not a verified count of currently affected users. The article does not demonstrate phishing, manipulated results or malware delivery, only that server-side routing would allow them.

    Technical Details

    • The hijack relies on Chrome's chrome_settings_overrides.search_provider manifest setting. It needs no sensitive permissions, background service worker, content scripts or functional UI. One sample, Safe Game Search, contained only a manifest and three icons.
    • The manifest sets an operator-controlled search endpoint as the default and supplies a separate autocomplete endpoint. The browser configuration performs the interception, so permission reviews alone cannot detect it.
    • The intermediary can observe queries and associate them with identifiers or network information. Operators monetize traffic through search syndication, using Yahoo's hspart/hsimp parameters or Bing's PC/PTAG values.
    • The proxy controls each destination. For Predator Search (50,000 users), six identical searches produced four outcomes: Yahoo results, intermediate domains and a Cloudflare error page.
    • Distribution relied on Google Ads and Bidbrain campaigns pointing to branded landing pages, often via popovers or popunders. Most of the extensions were unlisted in the Chrome Web Store.
    • Clusters: about 111 extensions and 2.2 million installs were linked to Intango LTD. The SecuryBrowse cluster covered 58 extensions and about 4.9 million users. A newer Bing-focused group had 37 extensions. Shared partner identifiers and synchronized updates linked the apparently separate publishers.
    • Chrome shows a search-change prompt at install, but it does not explain the downstream proxy routing.
    • Earlier Secure Annex research documented some extensions with broader permissions, so the whole set should not be called permission-free.
    • Investigators used store listings, privacy policies, ad transparency records, Censys, urlscan and DecryptAds.

    Remediation

    • Inventory installed extensions together with the configured default search provider and redirect chains.
    • Restrict unauthorized extensions by policy and investigate unexplained search changes.
    • Have users remove unfamiliar add-ons and verify their search engine setting.
    • A minimal manifest does not mean minimal security risk.