Browser Extensions Hijack Searches for 13 Million Users

• •319 browser extensions hijacked searches from 13.4 million users.
• •Extensions disguised as legitimate tools collect referral payments.
• •Microsoft identified 250 related extensions with tracking capabilities.

An investigation revealed that 319 malicious browser extensions have hijacked search queries from approximately 13.4 million users. These extensions, often disguised as legitimate tools, manipulate search results and collect referral payments from Yahoo and Bing. The extensions were found to be installed through deceptive advertising and are capable of redirecting users to potentially harmful sites. Microsoft identified at least 250 related extensions, which also tracked user activity and could lead to phishing or malware sites. Despite efforts to remove these extensions from official stores, new variants continue to emerge, indicating a persistent threat. The campaign has been ongoing for over a decade, exploiting the vulnerabilities in browser extension marketplaces. Users are advised to be cautious of extensions that do not provide clear value and to regularly review installed extensions for any suspicious activity.