Cybersecurity researcher **John Tuckner** of **Socket** has expanded on his April 2025 discovery, identifying an additional 264 malicious add-ons. This brings the total to 319 extensions, impacting millions of **Google Chrome** users. ### How the Hijacking Works According to Tuckner, the operators behind this scheme quietly take over the browser's default search engine. Every query is then routed through a suspicious proxy server, allowing them to collect partner referral payments from **Yahoo** or **Bing** using a syndication partner ID. These extensions masquerade as legitimate tools, such as PDF converters, manual finders, safe search, and AI search utilities. However, their primary function is to redirect user searches through a series of intermediary sites before landing on **Bing** or **Yahoo**. While hosted on the **Chrome Web Store**, many of these extensions are unlisted, meaning they don't appear in direct searches on the platform. Instead, they are promoted through deceptive advertisements found on various websites. ### Minimal Code, Maximum Impact Remarkably, many of these extensions require minimal code to achieve their objective. **Chrome**'s built-in `chrome_settings_overrides` setting allows them to replace the default search provider with ease. One analyzed example contained only a manifest and icons, lacking background scripts, content scripts, or requested permissions. Browser-hijacking extensions have long occupied a grey area between potentially unwanted programs (PUPs) and outright malware, with similar incidents reported for years. ### Beyond Ad Fraud: The Hidden Risks While the current focus of these extensions is revenue generation through search referrals, the potential risks extend far beyond ad fraud. Tuckner warns that the final destination of redirected searches can change at any time without requiring an extension update. This could include redirection to phishing sites or malicious downloads. "The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads," Tuckner explained. An illustrative example is the **Predator Search** extension, which redirected Tuckner to four different sites during six identical searches. This demonstrates the dynamic nature of the redirects, where the proxy server dictates the destination for each incoming search, even if the extension itself remains unchanged. ### Key Clusters and User Protection Among the largest recently active clusters, "**Bing-Search**" comprises 37 extensions with 2.2 million users, often promoted via **Bidbrain** ads. Another significant wave, "**SecuryBrowse**," includes 58 extensions and 4.9 million users, marketing itself with security-themed add-ons like **Fire Shield**, **Securify**, and **WatchTower**. While most of the identified extensions were removed from the **Chrome Web Store** at the time of the report's publication, new ones are continually being added. Users are strongly advised to uninstall any extensions listed in **Socket**'s report, perform a full antivirus scan of their systems, and exercise caution when downloading unnecessary tools and browser add-ons from unknown publishers.