Affected Systems

319 malicious Chrome extensions with 13.4 million combined installations. Extensions masquerade as PDF converters, manual finders, safe search, and AI search tools. Largest clusters include "Bing-Search" (37 extensions, 2.2M users) and "SecuryBrowse" (58 extensions, 4.9M users). Extensions are unlisted on Chrome Web Store but promoted via shady advertisements. All Chrome browser users who installed these extensions are affected.

Exploitation Status

Active campaign. 319 extensions actively hijacking user searches as of October 2024. Campaign expanded from 57 extensions (6M users) discovered in April 2025 to 264 additional extensions (8.7M users). Most extensions removed from Chrome Web Store at time of report publication, but new ones continuously added. Extensions use Chrome's 'chrome_settings_overrides' API to replace default search provider with minimal code.

Business Impact

Primary impact is search hijacking for advertising revenue through Bing and Yahoo referral programs. All user searches routed through attacker-controlled proxy servers, compromising privacy and enabling data collection. Secondary risk: proxy infrastructure can redirect users to phishing sites or malicious downloads at any time without updating extensions. Example shows same extension redirecting to four different destinations across six identical searches. Organizations face data exfiltration risk, credential theft potential, and compromised endpoint security. Extensions require minimal permissions and code, making detection difficult.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Cross-reference installed Chrome extensions against Socket's published list of 319 malicious extensions and immediately uninstall any matches across all endpoints
  • Deploy endpoint detection to identify Chrome extensions using 'chrome_settings_overrides' API and review for legitimacy, focusing on unlisted extensions not found via Chrome Web Store search
  • Run full antivirus scans on systems where malicious extensions were installed to detect potential secondary payloads or persistence mechanisms
  • Block network traffic to known proxy domains including searchlio.net, searchtosearch.com, and mcftink.com at firewall/proxy level
  • Implement browser extension whitelisting policy via Group Policy or MDM to prevent installation of extensions from unknown publishers, particularly those promoted through advertisements