SecOraLens
CriticalPhishing

319 Chrome Extensions Found Hijacking Searches, Affecting 13.4 Million Users

Cyber Security News·Source published ·1 min read

What happened?

A network of 319 browser extensions has been linked to search hijacking affecting roughly 13.4 million users over a decade. Marketed as PDF converters, manual finders, safe search tools, and AI search helpers, these extensions redirect queries through operator-controlled servers before sending users to Yahoo or Bing. The business model turns ordinary searches into referral income while exposing queries to an intermediary.

Key details

  • 319 Chrome extensions hijacked searches over a decade affecting 13.4 million users.
  • Extensions replaced default search engine via chrome_settings_overrides.search_provider setting.
  • Extensions redirected queries through operator servers to Yahoo or Bing for referral income.
  • Extensions were mostly unlisted in Chrome Web Store, installed via paid ads and direct links.
  • Operators earned money through search syndication programs sharing advertising revenue.
  • Privacy risk: queries exposed to intermediary revealing health, financial, workplace and personal data.

Affected

  • Extensions marketed as PDF converters, manual finders, safe search tools, and AI search helpers.
  • Extensions unlisted in Chrome Web Store, installed via paid advertisements and direct links.

Fixes and mitigations

  1. Remove unfamiliar add-ons and verify default search engine to address search hijacking.
  2. Organizations investigate unexplained search redirects and restrict unapproved extensions.

What to look for

  • Extension ID odkcfoohjiicbelloepgcomekdknchjh identified as Predator Search.
  • Domain search.safesearchgame[.]com used as search proxy.
  • Domain suggest.safesearchgame[.]com used for query suggestions.
  • Domain searchlio[.]net observed as destination.
  • Domain searchtosearch[.]com used as redirect intermediary.
  • Domain mcftink[.]com used for intermediate results.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories