Socket Identifies 264 Browser Extensions Hijacking Search Queries
Researchers identified 264 browser extensions that hijack search traffic via proxy servers to collect payments, affecting over 13 million users.
Socket researchers identified 264 browser extensions that replace default search engines and route queries through proxy servers, bringing the total to 319 extensions installed by 13.4 million users over a decade. These extensions request no permissions and contain almost no code, allowing them to bypass standard permission-based vetting.
The extensions originate from organized operators, including System1, Inuvo, BeFrugal, Intango LTD, and Tightrope Interactive. Intango has published about 111 extensions with 2.2 million installs across 279 domains since 2018. Tightrope Interactive ran about 200,000 Google ads across 307 domains. The 2024 SecuryBrowse wave added 58 extensions reaching 4.9 million users, while 37 Bing-focused extensions appeared starting in April 2025. Fifteen publishers pushed updates within the same four days in June 2026 using identical Bing partner tags.
Each extension changes the default search provider and sends queries through a proxy to collect syndication partner payments from Yahoo or Bing using tracking parameters like hspart=, hsimp=, PC=, and PTAG=. Many remain unlisted in the Chrome Web Store and are found through ads on content farms for tools like "PDF Manual Finder," "Safe Web Search," or "AI search." An analyzed extension contained only a manifest and three icon files, lacking permissions, background service workers, content scripts, and interfaces.
Extensions that ship code route searches through operator-controlled servers, recording search histories tied to unique identifiers. Predator Search, with 50,000 users, produced four distinct outcomes across six identical searches, including Yahoo with partner tags, searchlio.net, hops through searchtosearch.com and mcftink.com, and Cloudflare error pages.