Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users

A large-scale browser extension-based campaign has been hijacking user search queries across the Chrome Web Store, affecting approximately 13.4 million users. These extensions, often hidden and promoted via online ads, modify the browser's default search provider to route searches through proxy servers controlled by operators, who then monetize the traffic using partner referral IDs from Yahoo and Bing. The proxy infrastructure allows for dynamic redirection of search traffic, posing a risk for future malicious use such as phishing or malware distribution. Multiple organized operators, including Intango LTD, Tightrope Interactive, and unidentified groups behind 'SecuryBrowse' and 'Bing-Search', have been identified as running these campaigns over a decade.

AI-extracted · verify before operational use