An ongoing security investigation by Socket’s John Tuckner has discovered a search-hijacking campaign that involves 319 Chrome extensions with a combined 13.4 million downloads. The malicious extensions redirect search queries through tracking servers to generate advertising revenue from Bing and Yahoo
It’s more than double from Tuckner’s April report that found “only” 57 Chrome extensions and 6 million downloads.
According to Tuckner, the malicious extensions are usually found on websites advertising tools that are labeled as “PDF converter”, “AI search”, or “safe search”.
“These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser’s default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID,” Tuckner wrote.
The extensions apparently aren’t found on the official Chrome Web Store either. Rather, they’re unlisted and are only really found through the shady advertising.
How the extensions work
Apparently, the extensions use Chrome’s built-in ‘chrome_settings_override’ setting that lets them replace your default search provider.
What this means is that your searches are captured as they pass through the operator’s server. After that the redirect could be sent through a site with malware attached, though currently, per Tuckner they’re mostly routing to Yahoo and Bing and to falsely claim advertising revenue.
“The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads,” Tuckner said.
As of this writing, the report says that most of the extensions have been removed the Chrome Web Store when the report was published, however, new ones are constantly being added.
“Ultimately, Google can benefit from more advertisements being run and more extensions being listed in the marketplace so there may not be an urgent reason to police this activity too broadly.”
How to stay safe
Even if Google isn’t policing this specific type of extension, malicious add-ons do slip through to the Chrome Web Store from time to time. When it comes to extensions, you need to be extra careful when downloading and adding them to your browser.
Normally, we would recommend you stick to well-known extensions from trusted brands. However, sometimes a lone developer creates one that does exactly what you need.
There are several recommendations we have to help you be a bit safer. Check the ratings and reviews of the extensions but also dig into the developer to see if they’re legit.
Look, even good extensions can go bad, so you want to make sure that your Windows PC is protected with the best antivirus software and that you’re using the best Mac antivirus software on your Apple computer. That way, if an extension is spreading malware or other viruses, they’ll be detected and stopped before they can do any damage.
If you’re constantly trying different extensions, you should consider one of the best identity theft protection services. They can help get your identity back if it’s stolen or recover lost funds due to scams and cyberattacks.
