What happened
Socket says 319 Chrome browser extensions, installed by about 13.4 million users, quietly hijack people's searches and collect referral money from Yahoo and Bing. Its researcher John Tuckner expanded an April 2025 report of 57 extensions, adding 264 more that reach another 8.7 million users.
The extensions take over the browser's default search engine and send every query through a proxy the operators run before results reach Yahoo or Bing. Each listing earns partner referral payments under a syndication partner ID.
Most pose as PDF converters, manual finders, safe search or AI search tools, and many are unlisted so they never surface in Chrome Web Store searches. Rather than being found by users, they spread through paid advertising.
Background
The campaign is not new: the extensions tracked in the report go back to 2016. Most had been pulled from the Chrome Web Store by the time the report came out, but new ones keep appearing.
How it works
The trick needs almost no code. Chrome's built-in chrome_settings_overrides setting lets an extension replace the default search provider, so one analyzed example shipped only a manifest and a few icons, with no scripts or permissions.
Routing searches through the operator's server lets it see a user's complete search history. Because the server decides where each query lands, the extension itself never has to change.
Timeline
Socket first reports 57 search-hijacking extensions reaching 6 million users.[2]
Who is affected
- Anyone who installed one of the 319 extensions listed in Socket's report.
- Socket counts roughly 13.4 million users across the set.
Impact
Tuckner warns the operators could wait for valuable targets and then send a search to a phishing page, a fake results page or a malware lure.
One extension, Predator Search, sent six identical searches to four different places, among them the domains searchlio.net, searchtosearch.com and mcftink.com. Two of the biggest clusters, Bing-Search and SecuryBrowse, cover 37 and 58 extensions and about 2.2 million and 4.9 million users.
What to do
- Uninstall the extensions named in Socket's report from your browser.
- Run a full antivirus scan afterward.
- Avoid installing browser add-ons you do not need from unknown publishers.
Indicators of compromise
Shown defanged so they can't be clicked. Copy copies the real value. Every indicator appears in the cited source.
| Type | Indicator | Note | Copy |
|---|---|---|---|
| Extension ID | odkcfoohjiicbelloepgcomekdknchjh | Predator Search hijacker extension[1] | |
| Domain | searchlio[.]net | redirect destination from the Predator Search proxy[1] | |
| Domain | searchtosearch[.]com | redirect hop from the Predator Search proxy[1] | |
| Domain | mcftink[.]com | second results domain in the Predator Search redirect chain[1] | |
| Domain | search[.]safesearchgame[.]com | search proxy host for the Safe Game Search hijacker[1] |
Sources
- BleepingComputer · Chrome extensions with 13.4 million installs caught hijacking searches
Changelog
- First published.