319 Chrome extensions with 13.4 million installs hijacked searches

Socket found 319 Chrome extensions with a combined 13.4 million installs that quietly replaced the default search engine and routed queries through operator-controlled proxy servers to collect referral payments from Bing and Yahoo. The add-ons pose as PDF converters, search and AI tools and are promoted through shady ads.

• 319 extensions, 13.4 million installs; earlier tally was 57 extensions with 6 million users
• Largest active cluster Bing-Search: 37 extensions and 2.2 million users
• SecuryBrowse wave: 58 extensions and 4.9 million users
• Proxy can redirect to phishing at any time without an extension update