319 Malicious Chrome Extensions Steal Search Data

An ongoing security investigation has uncovered a widespread search-hijacking campaign involving 319 malicious Chrome extensions, collectively downloaded by an estimated 13.4 million users. This number represents a significant increase from previous findings. These extensions are primarily discovered through deceptive advertisements on websites, masquerading as tools such as PDF converters, AI search assistants, or safe search utilities.

The operators behind these malicious extensions utilize Chrome's built-in 'chrome_settings_override' feature to replace a user's default search provider. Consequently, every search query is routed through a proxy server controlled by the operators. While currently directing traffic mainly to Bing and Yahoo to claim advertising revenue, this setup allows for potential future redirection to malicious websites or phishing pages.

Most of the identified extensions have reportedly been removed from the Chrome Web Store following the investigation's publication. However, the report notes that new malicious extensions are continually being added, suggesting an ongoing challenge in policing this activity. Users are advised to exercise extreme caution when downloading browser extensions, checking ratings, reviews, and developer legitimacy, and ensuring their devices are protected by robust antivirus software.