Bing va Yahoo'dan reklama daromadi olish maqsadida foydalanuvchilarning qidiruvlarini kuzatuv serverlari orqali yo'naltirgan 319 ta Chrome kengaytmasi bilan bog'liq ulkan qidiruv o'g'irlash kampaniyasi jami 13,4 million o'rnatish soniga ega.
Socket tadqiqotchisi John Tucknerning yangi hisoboti 2025-yil aprel oyida 6 million foydalanuvchiga ega 57 ta Chrome kengaytmasi topilgan tadqiqotni kengaytirib, yana 8,7 million foydalanuvchiga ega 264 ta yangi qo'shimchani aniqladi.
"Bu kengaytmalar bir nechta uyushgan operatorlar tomonidan bir xil g'oyadan foydalanib yaratilgan: brauzerning standart qidiruv tizimini jimgina egallab olish, har bir so'rovni shubhali proksi-server orqali yo'naltirish va Yahoo yoki Bing'dan sindikatsiya hamkor ID'si ostida hamkorlik yo'llanma to'lovlarini yig'ish", deb tushuntirdi Tuckner.
Kengaytmalarning to'liq ro'yxati Socket hisobotining pastki qismida keltirilgan bo'lib, ular PDF konvertorlari, qo'llanma topuvchilari, xavfsiz qidiruv va AI qidiruv vositalari sifatida niqoblanadi. Biroq, asosan, kengaytmalar foydalanuvchilarning qidiruvlarini bir qator saytlar orqali yo'naltirib, oxir-oqibat Bing yoki Yahoo'ga olib boradi.
Ular Chrome Web Store'da, Chrome qo'shimchalari uchun Google'ning rasmiy portalida joylashgan bo'lsa-da, Socket ularning ro'yxatga olinmaganligini va kengaytma do'konidagi foydalanuvchi qidiruvlarida ko'rinmasligini aytadi.
Buning o'rniga, kengaytmalar veb-saytlarda topilgan shubhali reklama orqali targ'ib qilinadi.
Tuckner ko'plab kengaytmalarning maqsadiga erishish uchun deyarli hech qanday kod talab qilmasligini tushuntiradi, chunki Chrome'ning o'rnatilgan 'chromesettingsoverrides' sozlamasi ularga standart qidiruv provayderini almashtirish imkonini beradi.
Hisobotda tahlil qilingan bir misol faqat manifest va piktogrammalardan iborat bo'lib, fon skriptlari, kontent skriptlari yoki so'ralgan ruxsatlar yo'q.
Bunday brauzer o'g'irlash kengaytmalari uzoq vaqtdan beri potentsial keraksiz dasturlar (PUP) va zararli dasturlar o'rtasidagi chegarani xiralashtirib kelgan, BleepingComputer yillar davomida yuzlab shunga o'xshash kengaytmalar haqida xabar bergan.
Xavf reklama firibgarligidan ham oshib ketadi
Kengaytmalar hozirda qidiruv yo'llanmalar orqali daromad olishga e'tibor qaratgan bo'lib, foydalanuvchi qidiruvlarini Yahoo yoki Bing'ga yetishdan oldin operator nazoratidagi server orqali o'tkazadi.
Biroq, Tuckner oxirgi manzil kengaytmani yangilamasdan istalgan vaqtda o'zgarishi mumkinligi, jumladan foydalanuvchilarni fishing saytlariga yoki zararli yuklamalarga yo'naltirish mumkinligi haqida ogohlantiradi.
"Qidiruv yo'llanma daromadi foydali suv ichish joyi bo'lib, proksi operator ma'lumotlar to'planishi va nishonlar paydo bo'lishini kutib, keyin zararli qidiruv natijalari yoki fishing yoki boshqa zararli yuklamalar uchun ochilish sahifalariga yo'naltirishi mumkin", deb tushuntiradi Tuckner.
Bunga misol sifatida Predator Search kengaytmasi keltiriladi, u Tucknerni oltita bir xil qidiruvni bajarishda to'rtta turli saytga yo'naltirgan.
"Proksi qidiruv serveri orqali yuborilgan oltita bir xil qidiruv to'rtta turli joyga yetdi: to'g'ridan-to'g'ri Yahoo'ga hamkor teglar bilan (hspart=sz&hsimp=yhs-026), searchlio.net'dagi ochilish sahifasiga, searchtosearch.com orqali ikkinchi natijalar domeniga (mcftink.com) va keyin Yahoo'ga, hamda Cloudflare javob bermaydigan xato sahifasiga", deb xabar berdi Tuckner.
"Kengaytma hech qachon o'zgarmadi; proksi har bir qidiruv kelganda manzilni tanladi."
Yaqinda faol bo'lgan kengaytmalarning eng katta klasteri "Bing-Search" bo'lib, 37 ta kengaytma va 2,2 million foydalanuvchiga ega, ko'pincha Bidbrain reklamalari orqali targ'ib qilinadi. Yana biri "SecuryBrowse" to'lqini bo'lib, 58 ta kengaytma va 4,9 million foydalanuvchiga ega, Fire Shield, Securify va WatchTower kabi xavfsizlik mavzusidagi qo'shimchalarni targ'ib qiladi.
Tadqiqotchi hisobot chop etilganda bu kengaytmalarning aksariyati Chrome Web Store'dan olib tashlanganini aytdi. Biroq, yangilari doimiy ravishda qo'shilmoqda.
Foydalanuvchilar Socket hisobotida ro'yxatga olingan kengaytmalarni o'z brauzerlaridan o'chirishlari, tizimlarida to'liq AV tekshiruvini o'tkazishlari va noma'lum nashriyotlardan keraksiz vositalar va brauzer qo'shimchalarini yuklab olishdan qochishlari kerak.
BleepingComputer Socket topilmalari bo'yicha izoh olish uchun Google bilan bog'langan, ammo chop etish vaqti kelganda javob olmagan.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijoz ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnikadan texnikaga mudofaani o'lchaydi.
Hisobotni oling
A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo.
A new report by Socket's John Tuckner expands on the researcher's April 2025 discovery of 57 Chrome extensions with 6 million users, adding 264 newly identified add-ons with another 8.7 million users.
"These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID," explained Tuckner.
The extensions, with the full list shared at the bottom of Socket's report, pretend to be PDF converters, manual finders, safe search, and AI search tools. However, for the most part, the extensions simply redirect users' searches through a series of sites until they land on Bing or Yahoo.
Although they are hosted on the Chrome Web Store, Google's official portal for Chrome add-ons, Socket says they are unlisted and don't appear in users' searches on the extension store.
Instead, the extensions are promoted through shady advertisements found on websites.
Tuckner explains that many of these extensions need almost no code to achieve their goal, as Chrome's built-in 'chromesettingsoverrides' setting allows them to replace the default search provider.
One example analyzed in the report includes only a manifest and icons, with no background scripts, content scripts, or requested permissions.
Browser-hijacking extensions like these have long blurred the line between potentially unwanted programs (PUPs) and malware, with BleepingComputer reporting on hundreds of similar extensions over the years.
Risk extends beyond ad fraud
The extensions currently focus on revenue generation through search referrals, passing user searches through an operator-controlled server before they reach Yahoo or Bing.
However, Tuckner warns that the final destination can change at any time without updating the extension, including redirecting users to phishing sites or malicious downloads.
"The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads," explains Tuckner.
An example of this is the Predator Search extension, which redirected Tuckner to four different sites when performing six identical searches.
"Six identical searches sent through its proxy search server ended in four different places: straight to Yahoo with partner tags (hspart=sz&hsimp=yhs-026), a landing page on searchlio.net, a hop through searchtosearch.com to a second results domain (mcftink.com) before Yahoo, and a Cloudflare non-responsive error page," Tuckner reported.
"The extension never changed; the proxy chose each destination as the search came in."
The largest recently active cluster of extensions is "Bing-Search," with 37 extensions and 2.2 million users, often promoted through Bidbrain ads. Another one is the "SecuryBrowse" wave, with 58 extensions and 4.9 million users, promoting security-themed add-ons like Fire Shield, Securify, and WatchTower.
The researcher said most of these extensions had been removed from the Chrome Web Store when the report was published. However, new ones are constantly being added.
Users should uninstall the extensions listed in Socket's report from their web browsers, run a full AV scan on their systems, and avoid downloading unnecessary tools and browser add-ons from unknown publishers.
BleepingComputer has contacted Google for a comment on Socket's findings, but we have not received a response by publication.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
