These 319 Google Chrome Extensions Are Hijacking Your Search Results

You find a useful Chrome extension and install it, only to find that it barely does what it promised. But this isn’t just a useless Chrome extension. It quietly redirects your searches through the attacker's servers before sending them to Bing or Yahoo, allowing the operators to earn revenue in the process. This also means that the operators can see your search queries as they pass through their servers.

While these malicious redirects are currently being used to generate fraudulent ad revenue, Socket’s report warns that the same infrastructure could be used to redirect users to phishing sites and malicious downloads, potentially infecting devices with malware and enabling data theft and financial fraud.^[1]

Here's everything you should know about these fake extensions and how you can stay safe.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

How 319 Chrome extensions are hijacking search results

A total of 319 Chrome extensions, with a combined 13.4 million reported installations, have been found redirecting users’ searches to generate ad revenue from Bing and Yahoo. John Tuckner, a researcher at the security firm Socket, found 57 extensions with six million users in April 2025. He has now added 264 more extensions, with another 8.7 million reported installations, to this list in his new report.

All of these extensions take over your browser’s default search engine, send every search through their own servers, and earn referral fees from Yahoo or Bing. They disguise themselves as useful tools, such as manual finders, PDF converters, AI assistants, and safe search tools.

However, most of them do little besides redirecting your searches through a chain of sites until they reach Bing or Yahoo. Each search can carry the operator's partner ID, allowing them to earn referral revenue from your searches.

Although the extensions were hosted on the official Chrome Web Store, they were unlisted, which means you couldn't find them by searching the store. The report highlights that users found these extensions through shady ads on other websites.

One extension the researcher examined contained only a manifest file and icons, with no background scripts, content scripts, or requested permissions. Chrome has a built-in setting called chrome_settings_overrides that lets an extension replace your default search engine. This is why some of these extensions needed almost no code or special permissions, making them look harmless and difficult to flag.

Of the 319 extensions, 37 belong to the Bing-Search group, with 2.2 million reported installations, and were promoted through Bidbrain ads. Another 58 belong to the SecuryBrowse group, with 4.9 million reported installations. The latter disguised themselves as security tools with names like Securify, WatchTower, and Fire Shield.

The bigger security threat behind these Chrome extensions

While these operators are earning ad revenue by abusing Bing and Yahoo's syndication programs, these malicious extensions also put your privacy and data at risk. Every search passes through the operator’s server before it reaches Bing or Yahoo, meaning the operators can potentially see and collect your search queries.

Anyone's search history is one of the most revealing kinds of personal data. People search for all kinds of things, such as health symptoms, money problems, legal troubles, relationship issues, and personal matters. Even without your name attached, search queries could reveal sensitive details about your personal life, especially when combined with other information that could identify you.

One of the biggest concerns is that the extension doesn’t decide where your search goes; the operator's server does. The researcher tested the Predator Search tool, and six identical searches landed in four different places, while the extension itself never changed. This means that the operator can also send different users to different destinations.

While the infrastructure is currently being used to generate ad revenue, operators could later leverage it to lead users to phishing pages that look exactly like their bank's login pages. You enter your login credentials, and the attackers could immediately get hold of them. Attackers can also use these redirects to deliver malicious downloads, including malware, spyware, or ransomware.

How to protect yourself from malicious Chrome extensions

Most of the extensions had already been removed from the Chrome Web Store when the report was published. But new ones keep appearing, which is why you need to stay vigilant.

1. Check your Chrome extensions: Type chrome://extensions in your address bar and go through the whole list of extensions. Remove anything you don’t recognize or don’t remember installing. Pay special attention to PDF converters, manual finders, safe search tools, or AI search tools. You can also check your extensions against the full list of fake extensions from Socket's report.
2. Check your default search engine: Go to Settings > Search engine. If it’s set to something you don't recognize or Chrome says the setting is controlled by an extension, remove that extension immediately. If the problem keeps reappearing, reset Chrome by visiting chrome://settings/reset.
3. Run an antivirus scan: Run a full antivirus scan after removing malicious extensions. Scan your system using a reliable third-party antivirus program. This is especially important if you’ve been redirected to suspicious websites or downloaded something after being redirected.
4. Never install extensions from ads or pop-ups: Additionally, don't assume an extension is safe just because it’s on the Chrome Web Store. Before installing an extension, check the publisher, reviews, and the permissions it requests. Be wary of any extension that you can only access through a direct link and cannot find by searching the store.

If you've already installed such an extension, change the passwords for all your critical accounts, such as banking, social media, and email, from a different, clean device. Turn on two-factor authentication (2FA) wherever available.

The bottom line

In addition to allowing attackers to earn ad revenue from Bing and Yahoo, these Chrome extensions expose your search history and could potentially redirect you to convincing phishing pages or malicious websites that download malware onto your device.

Make sure you only install extensions from the official Chrome Web Store and avoid downloading them through shady ads. If you’ve installed one of these extensions, remove it immediately and run a full antivirus scan on your system. You can also use an identity theft protection tool as an added measure to monitor your personal information.

Robust Phishing Protection Backed by $1 Million in ID Theft Insurance

See Price

On Guardio's website

Antivirus Software

Guardio

• Browser security tool that monitors your email for phishing attempts and alerts you to data breaches tied to your address
• Monitors dark web exposure for up to 5 people, with individual, couples, and family plans available
• Includes up to $1M in identity theft insurance and a dedicated hotline if your identity is compromised

Author Details

Krishi Chowdhary

About the Author

Krishi Chowdhary specializes in digital privacy, cybersecurity, and consumer technology. He has written extensively on online privacy tools and broader cybersecurity topics, including online scams, data breaches, age verification, and emerging digital threats. Krishi believes technology reporting should empower readers, not confuse them, and is committed to making even the most technical subjects easy to understand without compromising on accuracy or depth. His work has appeared in leading technology publications, including CNET, ExpressVPN, and TechRadar, where he has covered topics ranging from cybersecurity incidents and privacy product announcements to artificial intelligence and major technology news