319 Malicious Chrome Extensions Hijacked Search for 13.4M Users

A new report by John Tucker of security firm Socket has identified 319 harmful extensions for Google Chrome and other Chromium-based browsers. Together they have been downloaded more than 13.4 million times.

The report extends an earlier investigation in which the researcher found 57 malicious add-ons. The count has now risen to 319.

How the scheme worked

According to the findings, the extensions were built by a handful of organized operators with the same plan. They quietly take over the browser's default search engine and route every query through a suspicious proxy server. The operators then collect affiliate commissions from Yahoo or Bing, based on a partner identifier.

The extensions do not appear especially malicious at this point. They redirect users' traffic through servers, which earns money for the fraudsters. Tucker warns, however, that this could change at any moment. Without any update, the add-ons could begin sending users to phishing sites designed to steal data.

What users should do

Most of the extensions have already been removed from the Chrome Web Store, but new ones keep appearing. They are actively promoted, among other channels, through social media ads. The full list of 319 extensions is published in Socket's report.

Users who have installed any of them should remove them as soon as possible and run a full scan with antivirus software. It is also worth checking whether the browser's default search engine has been changed without your consent, since that is the main sign of this kind of hijacking.

The case shows that removing extensions from the store does not stop the problem. Operators keep publishing new variants and advertising them outside the store, so installing add-ons only from sources you trust, and sparingly, remains the safest approach.