13.4 Million Users Exposed: How 319 Chrome Extensions Quietly Hijacked Every Search Query
In October 2026, security researchers at Socket uncovered a large-scale browser hijacking campaign involving 319 malicious Chrome extensions with a combined 13.4 million reported installations. These extensions—disguised as PDF converters, AI search tools, and safe-browsing utilities—silently replaced users' default search engines and routed queries through operator-controlled proxy servers before landing on Bing or Yahoo, generating fraudulent referral revenue. The extensions were unlisted on the Chrome Web Store and distributed via deceptive advertisements. Critically, the proxy destinations can be changed server-side at any time, meaning extensions already installed could pivot to delivering phishing pages or malicious downloads without any update to the extension itself. This campaign highlights a growing trend of supply-chain-style abuse of trusted browser extension ecosystems. As threat actors refine techniques to bypass platform review processes and leverage legitimate ad networks for distribution, organizations face escalating risk from endpoints compromised by seemingly benign productivity tools—underscoring urgent need for endpoint visibility, egress controls, and user-awareness programs.
Kill Chain
