Source: socket.dev
A large-scale investigation reveals 319 malicious browser extensions installed by approximately 13.4 million users that silently hijack browser default search engines and route queries through proxy servers. The extensions capture all user search queries and collect referral payments from Yahoo and Bing via search syndication partner IDs. These extensions are predominantly unlisted from the Chrome Web Store and distributed through paid advertising networks including Google Ads and Bidbrain. The operation has been running for nearly a decade, dating back to 2016, with multiple identified operators including Intango LTD, SecuryBrowse, and others. The proxy-based architecture allows operators to selectively redirect searches to potentially malicious pages, phishing sites, or malware lures. The Chrome Web Store has failed to adequately police this activity, with new extensions and domains appearing rapidly after takedowns. Researchers used Censys, Urlscan, and DecryptAds to systematically identify and attribute these campaigns to specific operators.
