319 Chrome extensions diverted users’ searches through servers controlled by their operators to earn advertising revenue from Bing and Yahoo. Socket counted 13.4 million installations in total; its investigation, authored by John Tuckner, adds 264 extensions to the 57 it had identified in April 2025.
The extensions were advertised as PDF converters, manual search tools, secure search tools, or artificial intelligence assistants. But, according to Socket, their primary function was to change the default search engine and route each query through a chain of servers before sending it to Bing or Yahoo. This allowed the operators to collect referral commissions associated with the searches.
A search engine change with very little code
The mechanism can rely on chrome_settings_overrides, an option in an extension’s manifest that allows the default search provider to be changed. Socket analyzed an extension consisting only of a manifest and some icons: it included no background scripts or content scripts and requested no additional permissions.
This minimal design can make an extension seem harmless if judged only by the permissions it requests. However, changing the search engine is enough to make queries pass through the operator’s infrastructure first. Socket warns that searches could be associated with a unique identifier, making it possible to link them over time.
“The extension never changed; the proxy chose each destination as the search came in.”
— John Tuckner, Socket
The test cited by Tuckner involved Predator Search: six identical searches ended up at four different destinations. Some went directly to Yahoo with partner tags; others passed through intermediate pages or ended up on a Cloudflare error page. The extension itself remained unchanged: the proxy server decided where to send each query.
Socket notes that the destination could change without updating the extension. Although most of the observed redirects were used to monetize searches, the operator could also direct specific queries to phishing pages, fake results, or malicious downloads. Malwarebytes clarifies that its review found no evidence that these extensions had carried out such malicious redirects.
Ads and hidden listings in the Chrome Web Store
Most of the identified extensions were marked as “unlisted” in the Chrome Web Store. Their listings could be opened through a direct link, but they did not appear in store searches. Socket describes ads on websites and advertising networks that promoted tools for solving specific tasks and led to those installation listings.
Among the highlighted groups, SecuryBrowse accounted for 4.9 million users across 58 extensions with protective-sounding names such as Fire Shield, Securify, and WatchTower. The Bing-Search group comprised 37 extensions and 2.2 million users, and was often promoted through Bidbrain ads. Together, the two groups represented 95 extensions and 7.1 million users.
The investigation traces the pattern back a decade, with extensions tracked since 2016. In the earlier finding, published in April 2025, Tuckner had identified 57 extensions with six million users; the new investigation adds another 264, with an additional 8.7 million users.
What to check and what remains unresolved
Socket recommends checking whether any installed extension appears on its list and removing it. It is also worth checking the default search engine in Chrome settings and running a full antivirus scan, as SoftZone advises. Malwarebytes recommends reviewing extensions on the browser’s extensions page and removing any that are unfamiliar or untrusted.
Most of the flagged extensions had already been removed from the Chrome Web Store when the investigation was published, according to Socket and BleepingComputer. Even so, Socket says new variants continue to appear. BleepingComputer reported that it had asked Google for comment on the findings and had not received a response by the time its article was published.
Sources: SoftZone, Socket, BleepingComputer, Malwarebytes
