Malware News Fake PDF and search tools hijacked searches for 13.4 million Chrome users

[Brownie2019]

Content source

https://www.malwarebytes.com/blog/news/2026/10/fake-pdf-and-search-tools-hijacked-searches-for-13-4-million-chrome-users

Ads promoted browser extensions as tools to find manuals, convert PDFs, or make searches safer. But many of these extensions sent users’ search queries through servers controlled by their operators.

Socket researcher John Tuckner identified 319 extensions with an estimated 13.4 million installs over a decade. The extensions hijacked users’ default search settings and routed their searches through servers controlled by the operators before sending them to Yahoo or Bing. This gave the operators access to users’ queries and let them earn referral payments.

Socket says the extensions were promoted through ads on networks including Google Ads, promoting tools such as “manual finders,” “PDF converters,” “safe search,” and “AI search.”

The extensions were listed in Google’s official store, but most were unlisted. That means people with a direct link could visit a listing and install an extension, while ordinary searches in the store would not show it. An ad offered help with an immediate task, a landing page encouraged installation, and the official store provided a familiar place to complete it.
Search hijacking

The main risk was that operators could see what users searched for. Searches can reveal health worries, financial problems, workplace interests, or other personal matters. Socket says queries were often associated with a unique identifier, which could let the operators link a user’s searches over time.

The proxy could also choose where to send a search. Socket says this could potentially direct users to phishing or malware pages, but it did not find evidence that the extensions had done so.
What should users do?

If your searches start going astray, or you installed a search, PDF-converter, manual-finder, or security extension after clicking an ad, check what’s installed.

Review your extensions. Enter chrome://extensions in Chrome’s address bar. Remove extensions you don’t recognize, no longer use, or don’t trust. To remove one, select Remove and confirm. If you’re unsure about an extension, check it against the list at the end of Socket’s blog.
Check your search settings. In Chrome, at the top right, select More (the three-dot menu), then Settings > Search engine. If Chrome says an extension is controlling a setting, review or remove that extension. The absence of this notice doesn’t confirm that all your extensions are safe.
Run a Malwarebytes scan to check for malicious extensions and other malware that could be affecting your device.

 

[Bot]

Hi Brownie2019. This is a useful reminder that a Chrome Web Store page is a distribution channel, not a security endorsement. Paid ads supplied the victims, while the official-looking listing supplied the trust.

One numerical caveat: 13.4 million is Socket’s aggregate estimate for 319 extensions identified across roughly a decade. It should not be read as 13.4 million users confirmed to be simultaneously infected today. The underlying behavior is nevertheless well supported: the extensions changed the default search provider and passed address-bar queries through operator-controlled proxies before Yahoo or Bing. Socket also found identifiers that could associate queries over time.

It is equally important not to turn capability into a confirmed incident. The proxy could selectively send someone elsewhere, but Socket reports no observed delivery of phishing or malware through these extensions. The demonstrated harm was search interception, profiling potential and referral monetization.

For anyone affected:

1. Remove the extension from chrome://extensions and review every Chrome profile in use.
2. Restore the intended search provider and inspect startup/new-tab settings. Google confirms that removing an extension controlling a setting should restore the previous value in its extension settings guidance.
3. If the extension returns or cannot be removed, check whether Chrome unexpectedly says it is managed and follow Google’s managed-browser checks. A genuinely work-managed device should go to its administrator.
4. If necessary, use Chrome’s documented settings reset—not random registry “fixes” from the Internet.
5. Run a reputable scan, but do not treat a clean result as proof that an unreviewed browser extension was harmless.

Landing on Yahoo or Bing alone does not identify this campaign; the meaningful clues are the unexpected intermediate redirect, changed search setting and responsible extension.

Simply having searches exposed does not automatically require changing every password. If credentials were entered on an unexpected page, however, change the affected password from a trusted device, revoke existing sessions and enable MFA. If a redirected page led to executing a download or command, that is a different and more serious exposure—use MalwareTips’ Malware Removal Assistance team for individual diagnosis.

Sources

• Search-UIX and unwanted search-engine redirects
• Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users
• Check if your Chrome browser is managed - Computer - Google Chrome Help
• Reset Chrome settings to default
• Manage extensions that change your settings - Chrome Web Store Help