Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users

You may have come across ads on webpages promoting "manual finder", "safe search", "PDF converter", or "AI search" tools which often end up as easy to install browser extensions. What are these extensions actually doing and who is behind them? This investigation expands on previous research with 264 newly identified extensions which exist only to capture users search queries impacting 8.7 million more users. This brings the total number of distinct extensions to 319 installed by roughly 13.4 million users across a decade of time.

These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID… but that might not be all.

These are not extensions users normally search for. In fact many of them are hidden in the Chrome Web Store. They are pushed into browsers through paid advertising (Google Ads, Bidbrain and more), often use shared landing pages tracking conversions, and are on the Chrome Web Store under shallow branding like Safe Web Search or PDF Manual Finder.

Why this is more important than just a potentially unwanted program:

• Every search you make is captured. Because your searches pass through the operator's server first, the operator sees your complete search history, often tied to a unique identifier.
• The redirect could be dangerous. The operator decides, per request, where your search actually ends up (similarly to a Traffic Distribution System). Today it leads to real results on Yahoo or Bing, but given enough time, a specific search string, or client geography, the results could show a phishing page, a fake results page, or a malware lure selectively.
• The Chrome Web Store hasn’t kept up. Even if extensions are taken down, there are new domains and lures popping up quickly after. We’ve seen evidence of this technique running continuously for a decade.

An extension whose only function is to intercept searches users could have made anyway, that is purposefully hidden from indexing, promoted through low-value advertising listings, and provides no additional value should be considered malicious by definition.

Search syndication monetization#

Yahoo and Microsoft operate search syndication programs where partners who bring search traffic get a revenue share on the resulting ads. The partner bringing the searches is assigned tracking IDs. For Yahoo it is the hspart=/hsimp= parameters. In Bing it is the PC= partner code and PTAG= partner tag sub-ID.

In browser extensions, there is a simple setting in the manifest file to change the default search provider. This is built into the framework for browser extensions, it is not even code that executes! For example, this manifest (plus three icon files) is the entirety of one of the extensions analyzed in this report.

{
  "update_url": "https://clients2.google.com/service/update2/crx",
  "manifest_version": 3,
  "version": "1.1",
  "name": "Safe Game Search",
  "short_name": "Game Safe Search",
  "description": "Real-time safety alerts for game searches and risky game websites",
  "default_locale": "en",
  "icons": {
    "16": "icon16.png",
    "48": "icon48.png",
    "128": "icon128.png"
  },
  "chrome_settings_overrides": {
    "search_provider": {
      "name": "Safe Game",
      "keyword": "Safe Game Search",
      "is_default": true,
      "encoding": "UTF-8",
      "favicon_url": "https://safesearchgame.com/favicon.ico",
      "search_url": "https://search.safesearchgame.com/query?q={searchTerms}",
      "suggest_url": "https://suggest.safesearchgame.com/querying/autocomplete?query={searchTerms}"
    }
  }
}

How to get more installs of extensions in order to generate more search revenue? Advertisements of course! The cost of promoting an advertisement which in turn generates search result revenue perpetuates the listing of more advertisements and extensions. Ultimately, Google can benefit from more advertisements being run and more extensions being listed in the marketplace so there may not be an urgent reason to police this activity too broadly.

Anatomy of a hijacker#

Above we saw a manifest for a search hijacker, but how is that really different from any other extension? Most of what people think makes up an extension is missing from that configuration:

• No permissions: what capabilities the extension requests access to
• No background service worker: the logic brains of any extension
• No content scripts: JavaScript injected into pages the extension requests access to
• No UI: the toolbar popup or options page

There is no utility in the extension outside of changing the default search provider. Changing the default search provider will trigger a prompt to the user during installation, but it will not clearly state where your searches end up going.

Many analyzing these extensions may incorrectly assume that since they request no permissions, there is no risk and move on. Here we make the case for why that is wrong.

Why a proxy?#

You might’ve noticed that your searches don’t actually go directly to Yahoo or Bing for search referral capture. As configured in the extensions that ship code, the actual flow is something like the following:

This is probably done for a few reasons:

1. A record of search referrals: measuring if search referrals match up with partner compensation.
2. A complete search capture point: every search query is captured and potentially monetized as trend or sentiment data. It could be geographically segmented or tied to specific IP sources.
3. A programmable redirect: this is the core "searchjacking" idea and builds on the previous two reasons. All redirects are decided server-side per request so the proxy operator can selectively serve different outcomes.

Through this research, most server redirects only appended partner tags to search results, but we did identify instances where a repeated search was redirected to Google's homepage without partner tags while other searches still went to Bing. This means redirects are chosen per request based on the search itself. The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads.

Predator Search (odkcfoohjiicbelloepgcomekdknchjh, 50,000 users) shows how much a single proxy can vary. Six identical searches sent through its proxy search server ended in four different places: straight to Yahoo with partner tags (hspart=sz&hsimp=yhs-026), a landing page on searchlio.net, a hop through searchtosearch.com to a second results domain (mcftink.com) before Yahoo, and a Cloudflare non-responsive error page. The extension never changed; the proxy chose each destination as the search came in.

It is only an assumption that these redirects could be malicious, but outside of needing to keep an accounting of all searches, the extensions could simply put the partner tags in the search provider override directly.

How extensions are “hidden”#

The Chrome Web Store includes an option for publishers to keep their extension unlisted from both the web store search and other indexers. The pages are accessible to anyone for viewing, but you either need to know the exact extension ID or be linked to it from another page. There can be good reasons why an extension would be unlisted, but we’ve seen it used by attackers to keep their malicious extensions from being easily discoverable.

A majority of the search hijacking extensions we found are unlisted in the Chrome Web Store. Why is it important for such a simple extension to be unlisted? How do 13.4 million users end up finding them?

These extensions are often promoted through advertisement networks. Most often they are shown as “pop overs” or “pop unders” on webpages. Generally these advertisements are of the “junk” advertising quality which is the most cost effective and lowest converting. When a user loads a web page, a quick “auction” is run deciding what advertisements to show a user and these end up being shown on some of the less desirable and signal poor parts of the internet like small monetized blogs and content farms. Ultimately, a lot of users do end up on these sites and get shown popovers to help them “Search PDFs” or “Find Manuals”. It only takes a few clicks to end up with the extension installed and forgotten about quickly after.

A decade of hijacks#

The extensions tracked in this report date back to 2016. To help understand the scale, if we thought of these as a single extension configuring a search provider, 13 million users would rank within the top 25 Chrome extensions by popularity currently. There have likely been many more extensions which fall into this pattern of behavior but have been removed or have gone undiscovered to this point.

• “Yandex search” published in 2016. A Russian-language MV2 extension that forced Yandex as the default search through the still-active extension-search.online. It had 200k users before it was taken down.
• HermesTab published in 2017 was a Yahoo new-tab hijacker across two extensions that totaled 400k users.
• Since 2018, Intango LTD has published about 111 extensions that reached roughly 2.2 million installs, spread across about 279 domains. Each extension got its own domain and its own admin@ mailbox, so every listing looked like an independent small publisher. Often several domains led to the same extension like newtabsearch.net and newtabhub.net. Domains often stay active even as their extensions are removed. Most send searches to Yahoo under Intango's partner account, but 15 send them to Bing (PC=INES*) instead. Intango's verified Google Ads account carries only 16 ads (October 2026), mostly for its "Search Direct" extension, so most of its installs come from somewhere else.
• Tightrope Interactive ran about 200,000 Google ads across 307 domains. The advertising account also features advertisements for iOS apps, Microsoft Store apps and Windows browsers.
• 2024 included the SecuryBrowse wave which was covered in previous research. 58 extensions with plausible security brands (”Fire Shield”, “Wise Ghost”, “Securify”, “Protecto”, “WatchTower”) reached ~4.9M users total. They often requested many sensitive permissions in addition to hijacking search.
• During 2025 and 2026 extensions appeared which focused on Bing redirection, usually pushed through Bidbrain advertisements, and difficult to attribute due to hidden domain registrations and lack of identification in privacy policies. Starting in April 2025, the same month previous research was released, 37 extensions were published. The group is clearly one actor. Fifteen seemingly independent extension publishers pushed updates within the same four days in June 2026. All use the same Bing partner account tags.

Finding the source of these extensions#

Unless you are served these ads for extensions, you practically can’t find them and identifying the owners of them can be even harder. We’ve developed a hunting methodology using a combination of the Chrome Web Store page, the extension’s landing page and Google Ads Transparency to gain insight into who may be behind these advertisements.

Identification

After being served an extension through an advertisement, you can click through the ad which sends you to a branded landing page with a single button requesting the user to install the extension with instructions for doing so. Sometimes it will redirect automatically to a Chrome Web Store page after a couple seconds.

Once at the Chrome Web Store listing, you can get the extension ID from the URL. While you cannot evaluate the extension code, you can attempt to search the ID in the Chrome Web Store search function. If you do not get a result back, the extension is a “hidden” one unlisted from search and indexing.

Privacy policies

When on an extension’s Chrome Web Store page, there is often a link to the extension’s privacy policy. Clicking through this you’ll be taken to the extension’s landing page which usually hosts the policy. In the privacy policy you may be able to identify a registered name for the company which made the extension, but it can be left out. Google usually reviews privacy policies prior to publishing an extension, but the requirements are loose and the privacy policy hosted outside of the web store can change at any time after review.

Ad transparency

Revisiting the branded landing page, you may be able to take the URL given and search Google Ads Transparency to find the organization posting the advertisement. Look for ‘Ads in anywhere’ to search all countries where an advertisement could be posted for full results.

While you cannot visit the links the advertisements go to from Google Ads Transparency, you will be shown the advertisement with the name of the company paying for them, in this case BrightWorks Technology LLC. Once you have the company’s advertiser ID, you can then pivot to see what other advertisements they post. From 400 advertisements related to the domain getsimplepdfsearch.com we are able to see that BrightWorks has over 3000 advertisements total for other types of extensions to download showing clear intent.

Systematically finding search hijackers#

Using a combination of Censys, Urlscan, and DecryptAds, we’ve developed a methodology that allowed us to pivot off of individual ads, fingerprint landing pages, and map out larger campaigns tied to real companies.

Censys searches#

Censys crawls the web and indexes contents on web pages. When you click on an advertisement and get sent to a landing page pointing to a browser extension for installation, Censys has often already visited and collected information from that page. Here are some Censys search queries that are helpful for finding landing pages.

Urlscan#

What Censys doesn’t record is a website’s behavior like where a link actually takes someone, what JavaScript adds after the page loads, and which domains are sending visitors to which install pages. Urlscan records each page as a browser loads it, so a single scan links the submitted URL, every redirect along the way, and the final rendered page. Urlscan depends on users to actively ‘scan’ websites in order to register them, but due to the prevalence of these advertisements and the fact that many web proxies submit to Urlscan automatically, there is a great corpus of data.

DecryptAds#

DecryptAds is a new service that collects the public files that record how ads are bought and sold: ads.txt and app-ads.txt (which sellers a site authorizes) and sellers.json (which company owns each seller account). It then connects them across the web. A search hijacker ad seen on a site can only have come through one of the few dozen exchanges and resellers listed in that site's ads.txt, which narrows the possible routes. sellers.json then names the companies behind those accounts. The same data can link operator-run sites, new-tab pages and typo domains that share a seller account, which is a strong ownership tie and harder to rotate than a domain. DecryptAds can help identify and link where these search hijack ads can run across the web.

Today DecryptAds covers only the selling side, so it can't name the advertisers buying the install ads. This gap is clearly an important one to discover malvertising in the industry and one I’m hoping they are able to help with!

Thank you#

This research would be much weaker without access to key platforms.

To Andrew Northern, Silas Cutler, Aiden Holland and more from the Censys team for providing research access.

Johannes Gilger of urlscan for research access helping to find additional pivots and historical records.

Zach Edwards at DecryptAds for filling in gaps in how malvertising, software and advertising networks operate.

Loading affected packages…