An ongoing security investigation by Socket's John Tuckner (via Bleeping Computer) has discovered a search-hijacking campaign that involves 319 Chrome extensions with a combined 13.4 million downloads. The malicious extensions redirect search queries through tracking servers to generate advertising revenue from Bing and Yahoo.

It's more than double from Tuckner's April report that found "only" 57 Chrome extensions and 6 million downloads.

According to Tuckner, the malicious extensions are usually found on websites advertising tools that are labeled as "PDF converter", "AI search", or "safe search".

"These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID," Tuckner wrote.

The extensions apparently aren't found on the official Chrome Web Store either. Rather, they're unlisted and are only really found through the shady advertising.

Apparently, the extensions use Chrome's built-in 'chrome_settings_override' setting that lets them replace your default search provider.

What this means is that your searches are captured as they pass through the operator's server. After that the redirect could be sent through a site with malware attached, though currently, per Tuckner they're mostly routing to Yahoo and Bing and to falsely claim advertising revenue.

"The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads," Tuckner said.

Source link