Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users

319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

You may have come across ads on webpages promoting "manual finder", "safe ", "PDF converter", or "AI " tools which often end up as easy to install browser extensions. What are these extensions actually doing and who is behind them? This investigation expands on research with 264 newly identified extensions which exist only to capture users queries impacting 8.7 million more users. This brings the total number of distinct extensions to 319 installed by roughly 13.4 million users across a decade of time.

These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID… but that might not be all.

These are not extensions users normally for. In fact many of them are hidden in the Chrome Web Store. They are pushed into browsers through paid advertising (Google Ads, Bidbrain and more), often use shared landing pages tracking conversions, and are on the Chrome Web Store under shallow branding like Safe Web or PDF Manual Finder.

Why this is more important than just a potentially unwanted program:

Every you make is captured. Because your searches pass through the operator's server first, the operator sees your complete history, often tied to a unique identifier.

The redirect could be dangerous. The operator decides, per request, where your actually ends up (similarly to a Traffic Distribution System). Today it leads to real results on Yahoo or Bing, but given enough time, a specific string, or client geography, the results could show a phishing page, a fake results page, or a malware lure selectively.

The Chrome Web Store hasn’t kept up. Even if extensions are taken down, there are new domains and lures popping up quickly after. We’ve seen evidence of this technique running continuously for a decade.

An extension whose only function is to intercept searches users could have made anyway, that is purposefully hidden from indexing, through low-value advertising listings, and provides no additional value should be considered malicious by definition.

syndication monetization #

Yahoo and Microsoft operate syndication programs where partners who bring traffic get a revenue on the resulting ads. The partner bringing the searches is assigned tracking IDs. For Yahoo it is the hspart= / hsimp= parameters. In Bing it is the PC= partner code and PTAG= partner tag sub-ID.

In browser extensions, there is a simple setting in the manifest file to change the default provider. This is built into the framework for browser extensions, it is not even code that executes! For example, this manifest (plus three icon files) is the entirety of one of the extensions analyzed in this report.

Anatomy of a hijacker #

Above we saw a manifest for a hijacker, but how is that really different from any other extension? Most of what people think makes up an extension is missing from that configuration:

No permissions : what capabilities the extension requests access to

No background service worker : the logic brains of any extension

No content scripts : JavaScript injected into pages the extension requests access to

No UI: the toolbar popup or options page

There is no utility in the extension outside of changing the default provider. Changing the default provider will trigger a prompt to the user during installation, but it will not clearly state where your searches end up going.

Many analyzing these extensions may incorrectly assume that since they request no permissions, there is no risk and move on. Here we make the case for why that is wrong.

You might’ve noticed that your searches don’t actually go directly to Yahoo or Bing for referral capture. As configured in the extensions that ship code, the actual flow is something like the following:

This is probably done for a few reasons:

A record of referrals: measuring if referrals match up with partner compensation.

A complete capture point: every query is captured and potentially monetized as trend or sentiment data. It could be geographically segmented or tied to specific IP sources.

A programmable redirect : this is the core "searchjacking" idea and builds on the two reasons. All redirects are decided server-side per request so the proxy operator can selectively serve different outcomes.

Through this research, most server redirects only appended partner tags to results, but we did identify instances where a repeated was redirected to Google's homepage without partner tags while other searches still went to Bing. This means redirects are chosen per request based on the itself. The referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious results or landing pages for phishing or other malicious downloads.

Predator ( odkcfoohjiicbelloepgcomekdknchjh , 50,000 users) shows how much a single proxy can vary. Six identical searches sent through its proxy server ended in four different places: straight to Yahoo with partner tags ( hspart=sz&hsimp=yhs-026 ), a landing page on searchlio.net , a hop through searchtosearch.com to a second results domain ( mcftink.com ) before Yahoo, and a Cloudflare non-responsive error page. The extension never changed; the proxy chose each destination as the came in.

It is only an assumption that these redirects could be malicious, but outside of needing to keep an accounting of all searches, the extensions could simply put the partner tags in the provider override directly.

How extensions are “hidden” #

The Chrome Web Store includes an option for publishers to keep their extension unlisted from both the web store and other indexers. The pages are accessible to anyone for viewing, but you either need to know the exact extension ID or be linked to it from another page. There can be good reasons why an extension would be unlisted, but we’ve seen it used by attackers to keep their malicious extensions from being easily discoverable.

A majority of the hijacking extensions we found are unlisted in the Chrome Web Store. Why is it important for such a simple extension to be unlisted? How do 13.4 million users end up finding them?

A decade of hijacks #

The extensions tracked in this report date back to 2016. To help understand the scale, if we thought of these as a single extension configuring a provider, 13 million users would rank within the top 25 Chrome extensions by popularity currently. There have likely been many more extensions which fall into this pattern of behavior but have been removed or have gone undiscovered to this point.

“Yandex ” published in 2016. A Russian-language MV2 extension that forced Yandex as the default through the still-active extension- .online . It had 200k users before it was taken down.

HermesTab published in 2017 was a Yahoo new-tab hijacker across two extensions that totaled 400k users.

Since 2018, Intango LTD has published 111 extensions that reached roughly 2.2 million installs, spread across 279 domains. Each extension got its own domain and its own admin@ mailbox, so every listing looked like an independent small publisher. Often several domains led to the same extension like newtabsearch.net and newtabhub.net . Domains often stay active even as their extensions are removed. Most send searches to Yahoo under Intango's partner account, but 15 send them to Bing ( PC=INES* ) instead. Intango's verified Google Ads account carries only 16 ads (October 2026), mostly for its " Direct" extension, so most of its installs come from somewhere else.

2024 included the SecuryBrowse wave which was covered in research. 58 extensions with plausible security brands (”Fire Shield”, “Wise Ghost”, “Securify”, “Protecto”, “WatchTower”) reached ~4.9M users total. They often requested many sensitive permissions in addition to hijacking .

319 extensions · ~13.44M users across a decade

200 extensions · ~5.68M users

Ad-tech company; maker of the Lumio browser. Includes 12 extension IDs advertised on its landing pages that were removed from the Chrome Web Store before they could be recorded.

Monetization IDs: Yahoo hspart=iba (acct 5056); Bing PC=INES* (15 extensions)

Consumer apps (Bible-video and bedtime-story apps), Windows browsers.

Monetization IDs: Yahoo hspart=tro ( fr=tightropetb , tbid 11745)

Unknown. Grouped by Google Ads buyer: Get Weather Today runs on Intango's Yahoo account ( hspart=iba ).

Runs BeFrugal , a cashback site.

Monetization IDs: Yahoo hspart=ssl & yhs-003 , yhs-001

Monetization IDs: Yahoo hspart=blp & yhs-foundai , yhs-simplyfound ; hspart=aztec & yhs-searchbit

Monetization IDs: Yahoo hspart=dcola & yhs-069 (oWebster, on ValidClick's partner account)

Owns "a variety of publisher sites and Chrome extensions".

Multi platform ecosystem of engaging digital assets and solutions.

Monetization IDs: Yahoo hspart=sz & yhs-044 , yhs-057

-syndication / pay-per-click ad network (Inuvo).

Monetization IDs: Yahoo hspart=dcola & yhs-109 , yhs-009 ; hspart=litmus & yhs-001 (Cleaner Searcher)

Ad-tech company (North Vancouver, since 2002).

System1 is a publicly traded -syndication company.

Monetization IDs: Yahoo hspart=sgp & yhs-1001 (via *.system1.partners ), hspart=infospace & yhs-090 (via *.s1search.co ), yhs-nearme

Monetization IDs: Yahoo hspart=infospace & yhs-mm_* , yhs-075 , yhs-035 , yhs-093

Monetization IDs: Yahoo hspart=infospace & yhs-bestfreemaps

Publicly traded ad-tech company with CodeFuel as its -monetization unit. Works as a resale network: publishers resell traffic into its Yahoo account ( hspart=fc ), each under its own sub-ID.

Monetization IDs: Yahoo hspart=fc & yhs-5527 , yhs-6228_2 , yhs-6333

Monetization IDs: Yahoo hspart=bc & yhs-sunrise

Software development company

Monetization IDs: Yahoo hspart=flowsurf & per-brand yhs-

Monetization IDs: axt.iadispatcher.com handler ( a=pc.typedin. )

IT and advertising services

Monetization IDs: Yahoo hspart=sz & yhs-026 / hspart=fc & yhs-5456 (rotates per request)

119 extensions · ~7.76M users

Monetization IDs: Bing PC=3QCV / PC=3CGP ( PTAG=1103 , 1306 , 1309 )

Unknown. Pushed through Bidbrain advertising networks.

Monetization IDs: Bing PC=3FPX / PC=3VSS (per-brand PTAG=13xx )

Monetization IDs: Bing PC=ARPL ( PTAG=ZQ.2.1.N.N.2.B13xx/B14xx )

Unknown. Includes an AliExpress affiliate redirector (40,000 users) that earns shopping commissions ( aff_fcid ) rather than revenue

Monetization IDs: Mixed

Finding the source of these extensions #

Once at the Chrome Web Store listing, you can get the extension ID from the URL. While you cannot evaluate the extension code, you can attempt to the ID in the Chrome Web Store function. If you do not get a result back, the extension is a “hidden” one unlisted from and indexing.

Systematically finding hijackers #

Using a combination of Censys, Urlscan, and DecryptAds, we’ve developed a methodology that allowed us to pivot off of individual ads, fingerprint landing pages, and map out larger campaigns tied to real companies.

DecryptAds is a new service that collects the public files that record how ads are bought and sold: ads.txt and app-ads.txt (which sellers a site authorizes) and sellers.json (which company owns each seller account). It then connects them across the web. A hijacker ad seen on a site can only have come through one of the few dozen exchanges and resellers listed in that site's ads.txt , which narrows the possible routes. sellers.json then names the companies behind those accounts. The same data can link operator-run sites, new-tab pages and typo domains that a seller account, which is a strong ownership tie and harder to rotate than a domain. DecryptAds can help identify and link where these hijack ads can run across the web.

Today DecryptAds covers only the selling side, so it can't name the advertisers buying the install ads. This gap is clearly an important one to discover malvertising in the industry and one I’m hoping they are able to help with!

This research would be much weaker without access to key platforms.

To Andrew Northern, Silas Cutler, Aiden Holland and more from the Censys team for providing research access.

Johannes Gilger of urlscan for research access helping to find additional pivots and historical records.

Zach Edwards at DecryptAds for filling in gaps in how malvertising, software and advertising networks operate.

Loading affected packages…