Security firm Socket found 319 Chrome add-ons that quietly swapped users' search engine and sent searches through tracking servers to earn ad money.
A free PDF converter or "safe search" add-on in Chrome may have been quietly rerouting your searches. Security firm Socket found 319 Chrome extensions, with 13.4 million reported installs combined, that took over the default search engine. Searches passed through tracking servers before landing on Bing or Yahoo, so the operators could collect ad referral money.
Researcher John Tuckner at Socket says a handful of organized operators are behind the add-ons. Their idea is simple: take over the browser's default search, send every search through a suspicious middle server, and earn partner payments from Yahoo or Bing. The add-ons posed as PDF converters, manual finders, safe search tools and AI search tools.
Some barely contain any code. One example had only a settings file and icons. Chrome has a built-in setting that lets an add-on replace the default search provider, and that was enough.
The add-ons were hosted on the Chrome Web Store, Google's official add-on shop. But Socket says they were unlisted, so they did not show up in store searches. Instead, they were pushed through shady ads on websites. That means many people may have installed one after clicking an ad, not after browsing the store.
For now, the main goal is making money from search referrals. The bigger worry is what could come next. Tuckner warns the final destination can change at any time without any update to the add-on. Searches could be sent to phishing sites, which try to trick you into giving up passwords, or to harmful downloads.
One add-on, Predator Search, showed how this works. Six identical searches ended in four different places, including Yahoo, a landing page, a multi-site detour and an error page. The add-on never changed. The middle server picked the destination each time.
Anyone who installed a search, safe search, PDF or manual-finder add-on from an ad or an unknown publisher should check. Two of the biggest groups were "Bing-Search" with 37 add-ons and 2.2 million users, and "SecuryBrowse" with 58 add-ons and 4.9 million users. The latter used security-sounding names like Fire Shield, Securify and WatchTower. If you have not added any such tools, you are far less likely to be affected.
The alert box above lists the steps. In short, review your add-ons, compare them with Socket's published list, and check that your default search engine is the one you chose.
Socket says most of these add-ons had been removed from the Chrome Web Store by the time its report came out. But new ones keep appearing. BleepingComputer has asked Google for comment and had not heard back at publication.
Check your Chrome add-ons today, and remove any search or PDF tool you do not recognize or did not choose yourself.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youMorristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
