[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsNKRNYwtbM49B5qXjxhMGPtgHEP-Lw9mGS0FgYgRMi8":3},{"article":4,"iocs":54,"watch_terms":65,"solutions":66,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"67ec184f-aefa-42fb-a85e-57983aa69c9b","Chrome extensions with 13.4 million installs caught hijacking searches","chrome-extensions-with-13-4-million-installs-caught-hijacking-searches-e12152","A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo. [...]","A large-scale search-hijacking campaign involving 319 Chrome extensions, collectively installed by 13.4 million users, has been uncovered. These extensions redirect user searches through malicious proxy servers to generate advertising revenue from Bing and Yahoo. While disguised as legitimate tools like PDF converters, they can also be repurposed to direct users to phishing sites or malicious downloads.","319 Chrome extensions with 13.4 million installs hijacked user searches.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fchrome-extensions-with-134-million-installs-caught-hijacking-searches\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F29\u002FChrome.jpg","2026-10-29T16:10:31+00:00","2026-10-29T17:01:07.323771+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Chrome extensions","product",{"name":21,"type":22},"Google","vendor",{"name":24,"type":22},"Microsoft",{"name":26,"type":19},"Predator Search",{"name":28,"type":19},"Bing-Search",{"name":30,"type":19},"SecuryBrowse","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62],{"type":56,"value":57,"context":58},"domain","searchlio.net","Redirected search results domain used by Predator Search extension.",{"type":56,"value":60,"context":61},"searchtosearch.com","Proxy server domain used by Predator Search extension.",{"type":56,"value":63,"context":64},"mcftink.com","Second search results domain used by Predator Search extension.",[21,24,18],{"controls":67,"vendors":152},[68,96,125],{"slug":69,"name":70,"problem":71,"products":72},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":90,"vendor_name":24,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":97,"name":98,"problem":99,"products":100},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":53,"name":126,"problem":127,"products":128},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[129,136,144],{"vendor_slug":130,"vendor_name":21,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[153,156],{"slug":130,"name":21,"logo_path":131,"roles":154},[155],"affected",{"slug":157,"name":158,"logo_path":159,"roles":160},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png",[161],"reported_by",{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":174},"134-million-users-hit-by-chrome-extension-search-hijacking-campaign","13.4 Million Users Hit by Chrome Extension Search-Hijacking Campaign","Over 300 malicious Chrome extensions, disguised as everyday productivity tools like PDF converters, were able to infiltrate the browser ecosystem and hijack user searches by routing them through attacker-controlled proxy servers. The root problem lies in users' inability to distinguish legitimate extensions from malicious ones, combined with insufficient vetting in the browser extension supply chain. This matters because extensions operate with elevated browser privileges, making them powerful vectors for data theft, phishing, and advertising fraud. The scale of 13.4 million installs demonstrates how easily trust in familiar-looking tools can be weaponized at a massive level.",[167,168,169,170,171,172,173],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation",{"MITRE ATT&CK T1566: Phishing":175,"NIST SP 800-53 SI-2: Flaw Remediation":176,"OWASP A06:2021 Vulnerable and Outdated Components":177,"CIS Control 14: Security Awareness and Skills Training":178,"CIS Control 2: Inventory and Control of Software Assets":179,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":180,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":181},"The extensions were designed to redirect users to phishing sites, making this a direct delivery mechanism for phishing attacks that user awareness and network controls could help mitigate.","A systematic process for identifying and remediating flawed or malicious software — including browser extensions — would have triggered faster detection and removal of the 319 implicated extensions.","Reliance on unvetted third-party browser extensions mirrors the risk of using vulnerable components, where malicious or compromised add-ons introduce critical security weaknesses into an otherwise secure environment.","Users who understand the risks of installing browser extensions from unverified sources are far less likely to install malicious tools disguised as PDF converters or similar utilities.","Maintaining an approved inventory of permitted browser extensions would have prevented unapproved, malicious extensions from being installed across user devices at scale.","Organizations are required to identify and address vulnerabilities in software in use, including third-party browser extensions that introduce unacceptable risk to the browsing environment.","Restricting which browser extensions can be installed via access control policies would have limited exposure by ensuring only vetted, approved extensions run in the browser environment."]