319 Chrome Extensions Quietly Hijack Searches

Researchers identified 319 suspicious Chrome extensions tied to roughly 13.4 million reported users. The extensions were promoted as useful tools, such as PDF converters and safe-search utilities, but silently changed the browser’s default search provider to route searches through operator-controlled systems. This created an opportunity to observe search activity and redirect users through changing search-result paths.

Key findings

• The investigation identified 319 suspicious extensions associated with approximately 13.4 million reported users over a decade.
• Extensions were presented as helpful tools, including manual finders, PDF converters, safe-search utilities, and AI search tools.
• The extensions could replace Chrome’s default search provider through manifest settings without requesting sensitive permissions or using executable extension logic.
• Searches were routed through operator-controlled infrastructure before users received Yahoo or Bing results.
• Google Ads and Bidbrain campaigns promoted branded landing pages that encouraged installation through popovers or popunders.
• Most identified extensions were unlisted in the Chrome Web Store, making direct links and advertising important distribution channels.
• Researchers linked groups of extensions through shared partner identifiers and synchronized updates, including clusters associated with Intango LTD and SecuryBrowse.

Who’s being targeted

• Commonly targeted roles: All employees, Chrome users, IT support, Desktop engineering, Security operations, Procurement and software-approval teams.
• Affected industries: Cross-industry, Consumer internet users, Organizations using Google Chrome.
• Attack channels: website.
• Impersonated: A legitimate-looking browser utility provider.

Awareness takeaways

• Install browser extensions only through approved channels, and be especially cautious with add-ons promoted through advertisements, popups, or direct links.
• Treat unexpected changes to your default search engine as a security warning and report them to IT or security.
• Do not assume an extension is safe just because it requests few permissions or appears technically simple.
• Remove unfamiliar browser add-ons and verify that your configured search engine is the one you selected.

Red flags to watch for

• The extension is promoted from a direct advertising link rather than a trusted store listing.
• The add-on promises a vague convenience feature but changes the browser’s search settings.
• The extension is unlisted in the Chrome Web Store or has little visible functionality.